Improper Privilege Management

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Privilege Management in the access field of the core group blueprint. An attacker can gain elevated privileges by saving a group with...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Security::detectXss function. An attacker can inject malicious JavaScript into page content by including an...

CVE-2026-62357

Dragonfly's CMS.INITBYDIM and CMS.INITBYPROB commands in src/core/cms.cc accept dimensions whose width × depth × sizeof(int64_t) overflows, allocating an undersized counter buffer. An unauthenticated remote client can then use CMS.INCRBY/CMS.QUERY with unbounded dimensions to corrupt or disclose ...

CVE-2026-75827

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-75837

Grav CMS before 2.0.14 lacks a security@: admin.super guard on the group blueprint access field. A delegated admin.users operator can save access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities. CISA classifies it as total impact; no public exploi...

CVE-2026-75837 Grav before 2.0.14 Privilege Escalation via Group Access Field

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with accessadminsuper=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities...

CVE-2026-75836

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction. While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize, the POST...

CVE-2026-75831

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

CVE-2026-75831 Grav before 2.0.15 Stored XSS via audio/video source URL

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

CVE-2026-75828 Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...

CVE-2026-75828 Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...

CVE-2026-75827

Grav before 2.0.15 uses an incomplete denylist in Blueprint dynamic-data validation, allowing attackers with page-edit or blueprint-config access to invoke error_log via a data directive and append PHP payloads to web-accessible files, achieving remote code execution. CVSS 4.0 score is 9.3 (CRITI...

CVE-2026-75827

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

WordPress WPML Multilingual CMS plugin <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter vulnerability

Authenticated Translator+ SQL Injection via 'sorting' Parameter vulnerability discovered by momopon1415 in WordPress Plugin Multilingual CMS versions = 4.9.5...

CVE-2026-75089 PHPGurukul Complaint Management System check_availability.php sql injection

A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/checkavailability.php. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-75089 PHPGurukul Complaint Management System check_availability.php sql injection

A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/checkavailability.php. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-75089

PHPGurukul Complaint Management System 1.0 is affected by a SQL injection vulnerability in the file user/check_availability.php, triggered by manipulation of the email parameter. The vulnerability allows remote, unauthenticated exploitation over the network with low complexity. A public proof-of-...

EUVD-2026-61145

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...