2181 matches found
Grav CMS 安全漏洞
Grav CMS is Grav open source a flat file-based content management system . Grav CMS suffers from a remote code execution vulnerability that originates from allowing authenticated administrators to upload malicious plugins via the admin/tools/direct-install interface, which can be exploited by an...
CVE-2025-50286
A Remote Code Execution RCE vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access...
CVE-2025-50286
A Remote Code Execution RCE vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access...
CVE-2025-50286
Grav CMS v1.7.48 with Admin Plugin v1.10.48 is vulnerable to Authenticated Remote Code Execution (RCE) . The vulnerability exists in the Direct Install feature located at the /admin/tools/direct-install interface. An authenticated administrator can upload a crafted plugin archive containing malic...
CVE-2025-50286
A Remote Code Execution RCE vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access...
CVE-2025-50286
A Remote Code Execution RCE vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access...
Grav Cross-Site Scripting Vulnerability (CNVD-2025-30357)
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. Grav suffers from a cross-site scripting vulnerability that stems from insufficient input validation of form fields. An attacker can exploit this...
CVE-2025-46199
Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields...
CVE-2025-46198
Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element...
CVE-2025-46198
Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element...
CVE-2025-46199
Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields...
PT-2025-30915 · Grav · Grav
Name of the Vulnerable Software and Affected Versions: grav versions prior to 1.7.49 Description: A Cross Site Scripting vulnerability exists in grav versions prior to 1.7.49. This allows an attacker to execute arbitrary code via a crafted script to the form fields. Recommendations: Update to gra...
CVE-2025-46199
Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields...
CVE-2025-46198
A Cross-Site Scripting (XSS) vulnerability exists in the grav content management system, affecting versions 1.7.46 , 1.7.47 , and 1.7.48 . The root cause is an unvalidated onerror attribute within the img element, which allows an attacker to execute arbitrary code . To remediate this vulnerabilit...
CVE-2025-46198: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element...
CVE-2025-46198
Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element...
Grav 安全漏洞
Grav is Grav's open source set of scalable CMS Content Management System for personal blogs, small content publishing platforms and one-page product displays. A security vulnerability exists in grav versions 1.7.48, 1.7.47, and 1.7.46, which stems from an unvalidated onerror attribute of the img...
CVE-2025-46199
The extensible CMS Grav is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to 1.7.49 (including v.1.7.48). The root cause is insufficient input validation of form fields, which allows an attacker to inject and execute a crafted script . This exploitation can lead to arbitrary co...