61 matches found
CVE-2026-75827
abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-75827 CVE-2026-75827 grav 2.0.13 — getgrav Grav 2.0.15 より前には、Blueprint の動的データにおけるベア関数検証に任意ファイル書き込みの脆弱性が存在します。この検証はポジティブな許可リストではなく不完全な拒否リストを使用しています。ページ編集またはブループリント設定へのアクセス権を持つ攻撃者は、データディレクティブを通じて errorlog 関数を呼び出し、Web からアクセス可能なファイルに PHP...
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...
GHSA-F8WV-XP27-6GQ7 Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...
Arbitrary Code Injection
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the errorlog function. An attacker can write arbitrary PHP code to web-accessible files by leveraging access to...
Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8wv-xp27-6gq7. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function...
CVE-2026-75827
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...
CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...
CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...
CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...
CVE-2026-44377 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates and Documents. The application unsafely evaluates user-supplied input directly through the Smarty templat...
EUVD-2011-3231
Malware in sbrugna...
EUVD-2001-1228
Malware in sbrugna...
EUVD-2006-3008
Malware in sbrugna...
EUVD-2001-1187
Malware in sbrugna...
CVE-2023-53375: Missing Release of Memory after Effective Lifetime
In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a memory leak: cd /sys/kernel/tracing...
DEBIAN-CVE-2023-53167
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix null pointer dereference in tracingerrlogopen Fix an issue in function 'tracingerrlogopen'. The function doesn't call 'seqopen' if the file is opened only with write permissions, which results in 'file-privatedata'...
CVE-2020-17449
PHP-Fusion 9.03 allows XSS via the errorlog file...
Design/Logic Flaw
PHP-Fusion 9.03 allows XSS via the errorlog file...
CVE-2020-17449
PHP-Fusion 9.03 is affected by CVE-2020-17449, a cross-site scripting (XSS) vulnerability that can be triggered via the error_log file. The NVD lists CVSS v3.1 base score 5.4 (MEDIUM) with network vector, low privileges, user interaction required, and changed scope; CVSS v2 is 3.5 (LOW). No concr...