Grav 跨站脚本漏洞

A cross-site scripting vulnerability exists in versions of Grav prior to 1.7.28, which stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit the vulnerability to execute JavaScript code on the client side...

Open Redirect in Grav

Common/Grav.php in Grav before 1.6.23 has an Open Redirect...

GHSA-WRXC-MR2W-CJPV Open Redirect in Grav

Common/Grav.php in Grav before 1.6.23 has an Open Redirect...

Cross-site Scripting (XSS) - Stored in getgrav/grav

Description Stored XSS is a vulnerability in which the attacker can execute arbitrary javascript code in the victim's browser. The XSS payload is stored in a webpage and it gets executed whenever someone visits that webpage. I used &58 instead of : in the href attribute of tag to bypass the xss...

Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin

Description grav-plugin-admin 1.10.25 has a Stored-XSS vulnerability that is executed when metadata information of a file whose name contains javascript are shown. Proof of Concept 1 - After installing grav+admin browse to http://127.0.0.1/admin/pages/home. 2 - Create a file named as follows:...

CVE-2021-3920

grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross site scripting

grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3920

The CVE-2021-3920 entry concerns grav-plugin-admin for Grav CMS. The vulnerability is Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting). The issue is a stored XSS in getgrav/grav-plugin-admin per the CVE record. Affected component: grav-plugin-admin plugin; root c...

CVE-2021-3920

grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3920 Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin

grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

PT-2021-22455

Name of the Vulnerable Software and Affected Versions grav-plugin-admin affected versions not specified Description The issue concerns Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software fails to properly neutralize user...

CVE-2021-3920: Improper Neutralization of Input During Web Page Generation

grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Path traversal in grav

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

GHSA-8C5P-4362-9333 Path traversal in grav

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Path Traversal

getgrav/grav is vulnerable to path traversal. An attacker can traverse the file system to access files or directories when using bin/grav server...

CVE-2021-3924

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

CVE-2021-3924

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Path traversal

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

CVE-2021-3924

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

CVE-2021-3924

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...