Skip to contentGetgrav vulnerabilities
Newest
- getgrav gravGrav Arbitrary File Read to Account TakeoverCVE-2024-34082Fix available8.5 High
- getgrav gravGrav vulnerable to Server Side Template Injection (SSTI) via Twig escape handlerCVE-2024-28119Fix available8.8 High
- getgrav gravGrav vulnerable to Server Side Template Injection (SSTI)CVE-2024-28118Fix available8.8 High
- getgrav gravGrav vulnerable to Server Side Template Injection (SSTI)CVE-2024-28117Fix available8.8 High
- getgrav gravServer-Side Template Injection (SSTI) with Grav CMS security sandbox bypassCVE-2024-28116Public exploitFix available8.8 High
- getgrav gravGrav File Upload Path Traversal vulnerabilityCVE-2024-27921Fix availableEPSS 60.8%8.8 High
- getgrav gravRemote Code Execution by uploading a phar file using frontmatterCVE-2024-27923Fix available8.8 High
- getgrav gravCross-site scripting (XSS) vulnerability in GravCVE-2023-31506Fix available5.4 Medium
- getgrav dom-sanitizerCross-site Scripting in DOMSanitizerCVE-2023-49146Fix available6.1 Medium
- getgrav gravServer-side Template Injection (SSTI) in gravCVE-2023-37897Fix available7.2 High
- getgrav gravGrav vulnerable to Self Cross Site Scripting in /forgot_passwordCVE-2023-344525.4 Medium
- getgrav gravGrav Server-side Template Injection (SSTI) via Twig Default FiltersCVE-2023-34448Fix available8.8 High
- getgrav gravGrav vulnerable to Server-side Template Injection (SSTI) via Denylist BypassCVE-2023-34253Fix available8.8 High
- getgrav gravGrav Server-side Template Injection via Insufficient Validation in filterFilterCVE-2023-34252Fix available8.8 High
- getgrav gravGrav Server Side Template Injection vulnerabilityCVE-2023-34251Fix available10.0 Critical
- getgrav getgrav/grav, grav +1 moreCode Injection in getgrav/gravCVE-2022-2073Fix availableEPSS 10.9%9.1 Critical
- getgrav getgrav/grav, grav +1 morestored xss in getgrav/gravCVE-2022-1173Fix available8.2 High
- getgrav getgrav/grav, grav +1 moreCross-site Scripting (XSS) - Stored in getgrav/gravCVE-2022-0970Fix available7.1 High
- getgrav getgrav/grav, grav +1 moreCross-site Scripting (XSS) - Stored in getgrav/gravCVE-2022-0743Fix available4.6 Medium
- getgrav getgrav/grav, grav +1 moreCross-site Scripting (XSS) - Stored in getgrav/gravCVE-2022-0268Fix available5.7 Medium
- getgrav getgrav/grav-plugin-admin, grav-plugin-admin +1 moreCross-site Scripting (XSS) - Stored in getgrav/grav-plugin-adminCVE-2021-39204.6 Medium
- getgrav getgrav/grav, grav +1 morePath Traversal in getgrav/gravCVE-2021-39248.8 High
- getgrav getgrav/grav, grav +1 moreCross-site Scripting (XSS) - Stored in getgrav/gravCVE-2021-3904Fix available6.3 Medium
- getgrav getgrav/grav, grav +1 moreReliance on Cookies without Validation and Integrity Checking in getgrav/gravCVE-2021-3818Fix available6.3 Medium
- getgrav getgrav/grav-plugin-admin, grav-plugin-admin +1 moreImproper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-adminCVE-2021-37995.4 Medium
- getgrav gravTwig allowing dangerous PHP functions by defaultCVE-2021-29440Public exploitFix availableEPSS 29.9%8.4 High
- getgrav grav admin, grav-plugin-admin +1 morePlugins can be installed with minimal admin privilegesCVE-2021-294397.2 High
- getgrav grav-plugin-adminUnauthenticated Arbitrary YAML Write/Update leads to Code ExecutionCVE-2021-21425Public exploitEPSS 80.6%9.3 Critical
- getgrav grav cmsGrav CMS Cross-Site Request Forgery (CSRF)CVE-2020-29553Fix available8.8 High
- getgrav grav cmsGrav CMS Arbitrary File DeletionCVE-2020-29555Fix available8.1 High
- getgrav grav cmsGrav CMS Local File InjectionCVE-2020-29556Fix available5.5 Medium
- getgrav gravGrav - Cross-Site Scripting in Admin Plugin Page EditorCVE-2020-37256Fix available5.1 Medium
- getgrav gravOpen Redirect in GravCVE-2020-11529Fix availableEPSS 10.9%6.1 Medium
- getgrav grav cmsCross-site Scripting in GravCVE-2019-16126Fix available6.1 Medium
- getgrav grav cmsGrav CMS Cross-site scripting (XSS) vulnerabilityCVE-2018-5233Fix available6.1 Medium