CVE-2021-3924

CVE-2021-3924 affects Grav (getgrav/grav) and is caused by an improper limitation of a pathname to a restricted directory (path traversal). The vulnerability is in the path handling logic of Grav, allowing access to files or directories outside the intended scope. Multiple connected sources confi...

CVE-2021-3924 Path Traversal in getgrav/grav

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

PT-2021-22487

Name of the Vulnerable Software and Affected Versions grav affected versions not specified Description The issue is related to Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This means that an attacker could potentially access files or directories...

CVE-2021-3924: Improper Limitation of a Pathname to a Restricted Directory

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Grav 路径遍历漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product presentations. A path traversal vulnerability exists in grav, which stems from an improper restriction of pathnames to restricted directories in the affected product...

Cross-Site Scripting in grav

grav prior to version 1.7.24 is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

GHSA-5JXC-HMQF-3F73 Cross-Site Scripting in grav

grav prior to version 1.7.24 is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin

Description In Grav, you can preview the file you uploaded by hovering your mouse to the file and clicking the info icon. The normal preview should be like this: However, I noticed that it is possible to perform XSS on the filename due to the following HTML Code: We can upload a file with a...

CVE-2021-3904

grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3904

grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross site scripting

grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3904

CVE-2021-3904 affects Grav (getgrav/grav) and is a Cross-Site Scripting vulnerability caused by improper input neutralization during web page generation. Multiple sources (including GHSA, Red Hat, NVD, OSV, and CVE CVELIST entries) describe it as XSS with Grav versions prior to 1.7.24 being affec...

CVE-2021-3904

grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3904 Cross-site Scripting (XSS) - Stored in getgrav/grav

grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3904: Improper Neutralization of Input During Web Page Generation

grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Grav 跨站脚本漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product presentations. A cross-site scripting vulnerability exists in grav, which stems from the vulnerability of grav to incorrect input neutralization "cross-site scripting"...

PT-2021-22358

Name of the Vulnerable Software and Affected Versions grav versions prior to 1.7.24 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for the injection of malicious scripts into web pages. No informatio...

Cross-site Scripting (XSS) - Stored in getgrav/grav

Description Grav is vulnerable to XSS. It is possible to use instead of : in tags. Proof of Concept Payload: HTML CLICK HERE 1: Edit a page with the payload user with low privileges. 2: Check out the target page and click on CLICK HERE. PoC video. Impact This vulnerability is capable of executing...

GHSA-CG3Q-59W7-RVC2 Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications c...

Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications c...