Grav CMS Detection (HTTP)

HTTP based detection of Grav CMS. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

Grav Input Validation Error Vulnerability

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. An input validation error vulnerability exists in the Common/Grav.php file in Grav versions prior to 1.6.23. The vulnerability stems from a web-based syst...

Open Redirect

getgrav/grav is vulnerable to open redirect. The vulnerability exists because the function redirect in Common/Grav.php does not validate the internal route parameter route and redirect to another location, allowing attackers to provide a malicious route to a location or file...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

Open redirect

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Grav before 1.7 has an open redirect in Common/Grav.php. The issue is partially fixed in 1.6.23 but remains in 1.6.x; Grav 1.7+ is affected by the resolved behavior. Nuclei and Veracode entries describe the risk as open redirect that can redirect users to a malicious site (phishing). Practical im...

Cross-site Scripting in Grav

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

GHSA-6268-V434-45M5 Cross-site Scripting in Grav

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS attacks. During uploading of a new avatar, parameters sent via SVG files are not sanitized, allowing an attacker to inject arbitrary Javascript into a victim's browser...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

Cross site scripting

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126

CVE-2019-16126 affects Grav up to 1.6.15 and describes a Stored Cross-Site Scripting (XSS) vulnerability caused by JavaScript execution in SVG images. The cited sources consistently indicate that uploading or handling SVG content can lead to arbitrary script execution in a victim’s browser, enabl...

Grav CMS 1.2.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications CVE-2018-5233 Grav CMS admin plugin Reflected Cross Site Scripting XSS vulnerability Description Grav CMS is a flat-file CMS using Markdown files for content management Official Website. It has been elected "Best Open Source CMS of 2016" by CM...

Grav CMS system/src/Grav/Common/Twig/Twig.php file cross-site scripting vulnerability

Grav CMS is a scalable CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. A cross-site scripting vulnerability exists in the system/src/Grav/Common/Twig/Twig.php file in Grav CMS version 1.3.0. A remote attacker can inject...

Cross site scripting

Cross-site scripting XSS vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin/tools...

CVE-2018-5233

Cross-site scripting XSS vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin/tools...