2165 matches found
CVE-2022-2073 Code Injection in getgrav/grav
Code Injection in GitHub repository getgrav/grav prior to 1.7.34...
CVE-2022-2073 Code Injection in getgrav/grav
Code Injection in GitHub repository getgrav/grav prior to 1.7.34...
CVE-2022-2073
CVE-2022-2073 is a Grav SSTI vulnerability in getgrav/grav prior to 1.7.34 where the Twig filter function could be abused to trigger unsafe calls. Grav patched filter() in 1.7.34, but attackers could still abuse other Twig core filters (e.g., map/reduce) to reach remote code execution unless thos...
Grav 代码注入漏洞
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A security vulnerability exists in Grav versions prior to 1.7.34, which stems from Grav's vulnerability to server-side template injection via Twig...
PT-2022-14839 · Unknown · Getgrav/Grav
Name of the Vulnerable Software and Affected Versions: getgrav/grav versions prior to 1.7.34 Description: The issue concerns Server Side Template Injection via Twig, where Twig should not render dangerous functions by default, such as system. This is related to Code Injection in the GitHub...
Local Command Injection Post-Installation of Dependencies
Description grav version x";touch pwned "/user/plugins/problems sh: 1: cd: can't cd to x SUCCESS cloned https://github.com/getgrav/grav-plugin-error - x";touch pwned "/user/plugins/error sh: 1: cd: can't cd to x SUCCESS cloned https://github.com/getgrav/grav-plugin-markdown-notices - x";touch pwn...
Grav CMS Local File Injection
The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...
Grav CMS Arbitrary File Deletion
The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...
GHSA-GPMF-Q5JH-HJX4 Grav CMS Arbitrary File Deletion
The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...
GHSA-FQFF-VCVX-68H3 Grav CMS Cross-Site Request Forgery (CSRF)
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website CSRF...
Grav CMS Cross-Site Request Forgery (CSRF)
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website CSRF...
GHSA-R3RG-JRJQ-W4MR Grav CMS Local File Injection
The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...
GHSA-977G-93F5-RQJX Grav CMS Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin/tools...
Grav CMS Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin/tools...
Grav Cross-Site Scripting Vulnerability
Grav is a scalable CMS content management system for personal blogs, small content publishing platforms, and single-page product displays. cross-site scripting vulnerabilities exist in versions prior to Grav 1.7.33, which stem from the application's lack of filtering and escaping of user data. An...
Cross-site Scripting (XSS)
getgrav/grav is vulnerable to cross site scripting. The vulnerability exists due to lack of sanitization of regular expression in the detectXss function allowing an attacker to inject maliciously crafted script via the browser in onX events...
GHSA-3P5M-J98P-C698 Stored cross site scripting in getgrav/grav
Stored cross-site scripting in GitHub repository getgrav/grav prior to 1.7.33...
CVE-2022-1173
stored xss in GitHub repository getgrav/grav prior to 1.7.33...
