2165 matches found
CVE-2023-34251 Grav Server Side Template Injection vulnerability
Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...
CVE-2023-34251
Grav (flat‑file CMS) versions before 1.7.42 are vulnerable to server‑side template injection (SSTI) that can enable remote code execution when a user with page editing privileges embeds malicious PHP on the administrator screen. The issue is mitigated by a fix in version 1.7.42. Public details in...
CVE-2023-34251 Grav Server Side Template Injection vulnerability
Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...
CVE-2023-34251 Grav Server Side Template Injection vulnerability
Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...
PT-2023-24776 · Grav · Grav
Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.42 Description: Grav is a flat-file content management system with a logic flaw in the GravExtension.filterFilter function. This flaw allows validation against a denylist of unsafe functions to be skipped when an...
PT-2023-24777 · Grav · Grav
Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.42 Description: The issue concerns a flat-file content management system where the denylist, introduced to prevent the execution of dangerous functions via malicious template injection, was insufficient. This allowe...
Grav 代码注入漏洞
Grav is a scalable CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A security vulnerability exists in Grav prior to version 1.7.42, which stems from a server-side template injection SSTI vulnerability that allows an attacker to...
Grav 代码注入漏洞
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A code injection vulnerability exists in Grav versions prior to 1.7.42, which stems from the presence of a server-side template injection SSTI vulnerability...
Grav 跨站脚本漏洞
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A cross-site scripting vulnerability exists in Grav 1.7.42 and earlier versions, which stems from a Reflected Cross-Site Scripting XSS vulnerability. The...
PT-2023-24883 · Grav +1 · Grav +1
Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.42 Description: The issue concerns a server-side template injection vulnerability leveraging the default filter function. This allows for remote code execution by invoking arbitrary unsafe functions through other...
Grav 代码注入漏洞
Grav is a scalable CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A security vulnerability exists in Grav versions prior to 1.7.42, which stems from a server-side template injection SSTI vulnerability...
Grav 代码注入漏洞
Grav is a scalable CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A security vulnerability exists in Grav prior to version 1.7.42, which stems from a server-side template injection SSTI vulnerability that allows an attacker to...
PT-2023-24888 · Grav · Grav
Name of the Vulnerable Software and Affected Versions: Grav versions 1.7.42 and prior Description: The issue concerns a self-reflected cross-site scripting vulnerability in the "/forgot password" page. This can be exploited by injecting a script into the email parameter of the request, potentiall...
PT-2023-24775 · Grav +1 · Grav +1
Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.42 Description: The issue allows for server-side template injection, which can lead to remote code execution. This can be achieved by embedding malicious PHP code on the administrator screen by a user with page...
Remote Code Execution
getgrav/grav is vulnerable to remote code execution. An authenticated remote attacker is able to cause server side template injection via Twig which renders risky functions by default, such as system...
GHSA-CXGW-R5JG-7XWQ Code injection in grav
Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system...
Code injection in grav
Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system...
CVE-2022-2073
Code Injection in GitHub repository getgrav/grav prior to 1.7.34...
