2165 matches found
CVE-2022-1173
CVE-2022-1173 affects Grav CMS: stored XSS in getgrav/grav prior to 1.7.33 due to insufficient input filtering/escaping. Impact is client-side JavaScript execution. No exploitation details are provided in the public documents beyond the vulnerability description. Remediation: upgrade Grav to 1.7....
CVE-2022-1173 stored xss in getgrav/grav
stored xss in GitHub repository getgrav/grav prior to 1.7.33...
Grav 跨站脚本漏洞
Grav is a scalable CMS content management system for personal blogs, small content publishing platforms, and single-page product displays. cross-site scripting vulnerabilities exist in versions prior to Grav 1.7.33, which stem from the application's lack of filtering and escaping of user data. An...
Server Side Template Injection
Description Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system. PoC video. Proof of Concept Payload: 'cat\x20/etc/passwd'|filter'system' 1. With an authenticated user,...
Grav Cross-Site Scripting Vulnerability (CNVD-2022-20517)
Grav is a scalable CMS content management system for personal blogs, small content publishing platforms, and single-page product displays. cross-site scripting vulnerabilities exist in versions prior to Grav 1.7.31, which stem from the program's lack of data validation filtering of user-supplied...
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to stored cross-site scripting. The vulnerability exists due to lack of xss validations for uploaded SVG files before they get stored which allows an attacker to inject and execute arbitrary javascript...
GHSA-R6HH-5G3Q-WWGC Stored Cross-site Scripting in grav
Grav prior to 1.7.31 is vulnerable to stored cross-site scripting...
Stored Cross-site Scripting in grav
Grav prior to 1.7.31 is vulnerable to stored cross-site scripting...
The grav application allows large characters to insert in the input field "Full Name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request
Proof of Concept: 1. Go to http://site/admin/accounts/users/testuser 2. There will a Full name input field 3. Add more than 1 lakhs+ characters to the Full name field 4. You will see the application accepts large characters and if we will increase the characters then it can lead to Dos. POC Image...
CVE-2022-0970
Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...
CVE-2022-0970
Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...
Cross site scripting
Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...
CVE-2022-0970
CVE-2022-0970 concerns Grav CMS (getgrav/grav). The vulnerability is a stored cross-site scripting issue in Grav prior to 1.7.31 caused by lack of proper data validation/filtering of user-supplied data and output, enabling JavaScript execution on the client side. The available connected documenta...
CVE-2022-0970 Cross-site Scripting (XSS) - Stored in getgrav/grav
Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...
Grav 跨站脚本漏洞
Grav is a scalable CMS content management system for personal blogs, small content publishing platforms, and single-page product displays. cross-site scripting vulnerabilities exist in versions prior to Grav 1.7.31, which stem from the program's lack of data validation filtering of user-supplied...
GHSA-2P89-PPC2-MRQ4 Cross site scripting in getgrav/grav
User input is not properly sanitized leading to cross site scrpting xss in grav...
Cross site scripting in getgrav/grav
User input is not properly sanitized leading to cross site scrpting xss in grav...
Grav Cross-Site Scripting Vulnerability (CNVD-2022-71110)
Grav is a scalable CMS content management system for personal blogs, small content publishing platforms, and single-page product displays. cross-site scripting vulnerabilities exist in versions prior to Grav 1.7.31, which stem from the application's lack of data validation filtering of...