CVE-2026-92916

Grav, a flat-file CMS, is affected by an unauthenticated information disclosure in versions 1.7.0–1.7.53.2 and 2.0.0–2.0.21 when the debugger is enabled (system.debugger.enabled: true, not the default). The Clockwork profiler endpoint (/__clockwork/) is intercepted during bootstrap without any au...

EUVD-2026-81438

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...

CVE-2026-92916

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...

CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...

CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...

CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...

CVE-2026-92916: Exposure of Sensitive Information to an Unauthorized Actor

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...

PT-2026-94239

Name of the Vulnerable Software and Affected Versions Grav versions 1.7.0 through 1.7.53.2 Grav versions 2.0.0 through 2.0.21 Description When the debugger is enabled via system.debugger.enabled: true, the Clockwork profiler endpoint is exposed without authentication. The...

Clockwork Dashboard Exposure Detection

Clockwork Dashboard is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Clockwork Dashboard is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Clockwork Dashboard Exposure Detection', 'description':...

Laravel Clockwork - Sensitive Information Exposure Detection

Laravel Clockwork itsgoingd/clockwork was detected as enabled and publicly accessible. When left active in production, it exposes SQL queries, request data, session variables, mail logs, and application internals to any visitor. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel Clockwork...

Clockwork PHP page exposure Detection

Clockwork php page was exposed, which allows admins to profile and debug the application, view database queries, HTTP requests, and other details right from the browser's developer tools. !/usr/bin/env python3 -- coding: utf-8 -- """Clockwork php page was exposed, which allows admins to profile a...

EUVD-2017-8931

Malware in sbrugna...

EUVD-2023-0750

Malicious code in bioql PyPI...

EUVD-2023-55576

Malicious code in bioql PyPI...

CVE-2023-25015

Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF...

CVE-2023-50843

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Clockwork Clockwork SMS Notfications.This issue affects Clockwork SMS Notfications: from n/a through 3.0.4...

Clockwork Unrestricted Access

By default, Clockwork does not require authentication to access the dashboard. This allows an attacker to access sensitive data such as database queries and incoming requests. No source data...

Clockwork Detected

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Clockwork instance on the target application. No source data...

CVE-2023-50843

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Clockwork Clockwork SMS Notfications.This issue affects Clockwork SMS Notfications: from n/a through 3.0.4...

CVE-2023-50843

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Clockwork Clockwork SMS Notfications.This issue affects Clockwork SMS Notfications: from n/a through 3.0.4...