Cross-site Scripting in Grav

2019-11-0820:06:08

Google

osv.dev

0.001 Low

EPSS

Percentile

44.9%

JSON

Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.

CPENameOperatorVersion
getgrav/graveq1.1.0-rc.2
getgrav/graveq1.3.0-rc.2
getgrav/graveq0.9.8
getgrav/graveq0.9.16
getgrav/graveq1.0.4
getgrav/graveq1.1.9-rc.1
getgrav/graveq0.9.23
getgrav/graveq1.6.0-beta.3
getgrav/graveq1.6.3
getgrav/graveq1.6.30

Name	Operator	Version
getgrav/grav	eq	1.1.0-rc.2
getgrav/grav	eq	1.3.0-rc.2
getgrav/grav	eq	0.9.8
getgrav/grav	eq	0.9.16
getgrav/grav	eq	1.0.4
getgrav/grav	eq	1.1.9-rc.1
getgrav/grav	eq	0.9.23
getgrav/grav	eq	1.6.0-beta.3
getgrav/grav	eq	1.6.3
getgrav/grav	eq	1.6.30