getgrav/grav vulnerabilities (Packagist)
105 vulnerabilities.
getgrav/gravPackagistGrav: Stored XSS via Markdown media attribute() action in Grav CMS6.9 Mediumgetgrav/gravPackagistGrav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature9.1 Criticalgetgrav/gravPackagistGrav CMS Cache Value FileCache.php doGet deserialization2.3 Lowgetgrav/gravPackagistGrav may be vulnerable to SSRF attack via Twig Templates9.1 Criticalgetgrav/gravPackagistGrav is vulnerable to Stored XSS through authenticated user-edited content5.4 Mediumgetgrav/gravPackagistGrav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor6.1 Mediumgetgrav/gravPackagistGrav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`6.2 Mediumgetgrav/gravPackagistGrav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters6.2 Mediumgetgrav/gravPackagistGrav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab6.2 Mediumgetgrav/gravPackagistGrav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab6.2 Mediumgetgrav/gravPackagistGrav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`6.8 Mediumgetgrav/gravPackagistGrav Admin Plugin vulnerable to User Enumeration & Email Disclosure6.5 Mediumgetgrav/gravPackagistGrav vulnerable to Information Disclosure via IDOR in Grav Admin Panel4.3 Mediumgetgrav/gravPackagistGrav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter6.9 Mediumgetgrav/gravPackagistGrav Exposes Password Hashes Leading to privilege escalation6.2 Mediumgetgrav/gravPackagistGrav is vulnerable to a DOS on the admin panel4.9 Mediumgetgrav/gravPackagistGrav vulnerable to Path Traversal allowing server files backup6.8 Mediumgetgrav/gravPackagistGrav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions8.6 Highgetgrav/gravPackagistGrav is vulnerable to Arbitrary File Read8.5 Highgetgrav/gravPackagistSecurity Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS8.8 Highgetgrav/gravPackagistGrav is vulnerable to Server-Side Template Injection (SSTI) via Forms7.7 Highgetgrav/gravPackagistGrav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection7.4 Highgetgrav/gravPackagistGrav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover8.8 Highgetgrav/gravPackagistGrav is vulnerable to RCE via SSTI through Twig Sandbox Bypass8.7 Highgetgrav/gravPackagistGrav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption8.8 Highgetgrav/gravPackagistGrav Cross-site Scripting vulnerability6.1 Mediumgetgrav/gravPackagistGrav Arbitrary File Read to Account Takeover8.5 Highgetgrav/gravPackagistGrav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler8.8 Highgetgrav/gravPackagistGrav vulnerable to Server Side Template Injection (SSTI)8.8 Highgetgrav/gravPackagistGrav vulnerable to Server Side Template Injection (SSTI)8.8 Highgetgrav/gravPackagistServer-Side Template Injection (SSTI) with Grav CMS security sandbox bypass8.8 Highgetgrav/gravPackagistGrav File Upload Path Traversal vulnerability8.8 Highgetgrav/gravPackagistRemote Code Execution by uploading a phar file using frontmatter8.8 Highgetgrav/gravPackagistCross-site scripting (XSS) vulnerability in Grav5.4 Mediumgetgrav/gravPackagistServer-side Template Injection (SSTI) in grav7.2 Highgetgrav/gravPackagistGrav Server-side Template Injection (SSTI) via Twig Default Filters8.8 Highgetgrav/gravPackagistGrav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass8.8 Highgetgrav/gravPackagistGrav Server-side Template Injection via Insufficient Validation in filterFilter8.8 Highgetgrav/gravPackagistGrav Server Side Template Injection vulnerability10.0 Criticalgetgrav/gravPackagistCode Injection in getgrav/grav9.1 Criticalgetgrav/gravPackagiststored xss in getgrav/grav8.2 Highgetgrav/gravPackagistCross-site Scripting (XSS) - Stored in getgrav/grav7.1 Highgetgrav/gravPackagistCross-site Scripting (XSS) - Stored in getgrav/grav4.6 Mediumgetgrav/gravPackagistCross-site Scripting (XSS) - Stored in getgrav/grav5.7 Mediumgetgrav/gravPackagistPath Traversal in getgrav/grav8.8 Highgetgrav/gravPackagistCross-site Scripting (XSS) - Stored in getgrav/grav6.3 Mediumgetgrav/gravPackagistReliance on Cookies without Validation and Integrity Checking in getgrav/grav6.3 Mediumgetgrav/gravPackagistTwig allowing dangerous PHP functions by default8.4 Highgetgrav/gravPackagistGrav CMS Cross-Site Request Forgery (CSRF)8.8 Highgetgrav/gravPackagistGrav CMS Arbitrary File Deletion8.1 High- Show moreLoading…