Lucene search
EffectrenanB1182515-D911-4DA9-B4F7-B4C341A62A8DHistoryOct 20, 2021 - 2:02 p.m.
Cross-site Scripting (XSS) - Stored in getgrav/grav
2021-10-2014:02:21
effectrenan
www.huntr.dev
4
0.001 Low
EPSS
Percentile
21.6%
Description
Grav is vulnerable to XSS. It is possible to use : instead of : in <a> tags.
Proof of Concept
Payload:
<a href>CLICK HERE</a>
1: Edit a page with the payload (user with low privileges).
2: Check out the target page and click on CLICK HERE.
Impact
This vulnerability is capable of executing JS code.
Related
cve
cve
CVE-2021-3904
2021-10-27 22:15:07
osv
osv
Cross-Site Scripting in grav
2021-11-01 19:17:31
CVE-2021-3904
2021-10-27 22:15:07
prion
prion
Cross site scripting
2021-10-27 22:15:00
nvd
nvd
CVE-2021-3904
2021-10-27 22:15:07
veracode
veracode
Cross-Site Scripting (XSS)
2021-10-28 03:41:07
github
github
Cross-Site Scripting in grav
2021-11-01 19:17:31
cvelist
cvelist
CVE-2021-3904 Cross-site Scripting (XSS) - Stored in getgrav/grav
2021-10-27 21:10:15