Getgrav Grav-plugin-login vulnerabilities
- getgrav grav-plugin-loginGrav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite8.7 High
- getgrav grav-plugin-login-oauthGrav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass9.3 Critical
- getgrav grav-plugin-loginGrav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page8.5 High
- getgrav grav-plugin-loginGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie8.6 High
- getgrav grav-plugin-loginGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form8.6 High
- getgrav grav-plugin-loginGrav Login Plugin before 3.9.1 Email Enumeration via Registration9.3 Critical
- getgrav grav-plugin-loginCSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)5.4 Medium
- getgrav grav, grav-plugin-login +1 moreGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge7.4 High