CVE-2020-29555

The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...

CVE-2020-29556

The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...

CVE-2020-29556

The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...

CVE-2020-29556

CVE-2020-29556 (Grav CMS) : The Backup functionality in Grav CMS up to 1.7.0-rc.17 enables an attacker to read arbitrary local files on the server via path traversal. The issue can be exploited by an unauthenticated attacker due to missing CSRF protection. This is supported by Red Hat and vulnera...

CVE-2020-29553: Cross-Site Request Forgery (CSRF)

The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website CSRF...

PT-2021-11693

Name of the Vulnerable Software and Affected Versions: Grav CMS versions through 1.7.0-rc.17 Description: The issue in Grav CMS allows an attacker to read arbitrary local files on the server using a path-traversal technique. This can be exploited by both authenticated and unauthenticated attacker...

PT-2021-11692

Name of the Vulnerable Software and Affected Versions: Grav CMS versions 1.7.0-rc.17 and earlier Description: The issue allows an authenticated attacker to delete arbitrary files on the server using a path-traversal technique. Additionally, an unauthenticated attacker can exploit this due to a la...

Grav 路径遍历漏洞

Grav is a flat file CMS that uses Markdown files for content management. An arbitrary file deletion vulnerability exists in the BackupDelete feature of Grav 1.7.0-rc.17 and earlier versions. An attacker can exploit this vulnerability by using path traversal techniques to delete arbitrary files on...

Grav 路径遍历漏洞

Grav is a flat file CMS that uses Markdown files for content management. A path traversal vulnerability exists in the backup feature of Grav 1.7.0-rc.17 and earlier versions. An attacker can exploit this vulnerability to read arbitrary local files on the underlying server...

PT-2021-11691

Name of the Vulnerable Software and Affected Versions: Grav CMS versions through 1.7.0-rc.17 Description: The issue allows an attacker to execute system commands or read and delete arbitrary files on the server by exploiting path-traversal techniques and a lack of CSRF protection. This can be...

CVE-2020-29555: Improper Limitation of a Pathname to a Restricted Directory

The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...

CVE-2020-29556: Improper Limitation of a Pathname to a Restricted Directory

The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...

Grav 跨站请求伪造漏洞

Grav is a flat file CMS that uses Markdown files for content management. A cross-site request forgery vulnerability exists in the scheduler in Grav 1.7.0-rc.17 and earlier versions. An attacker can exploit this vulnerability to execute system commands by tricking an administrator into visiting a...

Grav CMS 1.6.30 Cross Site Scripting

Exploit Title: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting Date: 13-12-2020 Exploit Author: Sagar Banwa Vendor Homepage: https://getgrav.org/ Software Link: https://getgrav.org/downloads Version: Grav v1.6.30 - Admin v1.9.18 Tested on: Windows 10/Kali Linux...

Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting

Exploit Title: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting Date: 13-12-2020 Exploit Author: Sagar Banwa Vendor Homepage: https://getgrav.org/ Software Link: https://getgrav.org/downloads Version: Grav v1.6.30 - Admin v1.9.18 Tested on: Windows 10/Kali Linux...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS. A user with the ability to edit pages is able to inject and execute malicious code due to insecure default security configuration when using Admin plugin to edit pages...

Cross-Site Scripting in Grav

Impact Privileged users with the ability to edit pages have a mechanism to perform remote code execution via XSS. At a minimum, the vulnerability represents a bypass of security controls put in place to mitigate this form of attack. The remote code execution can be performed because XSS would all...

PT-2026-52606

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.6.30 Description A cross-site scripting issue exists in the default security configuration of the Admin plugin page editor. Privileged users with page editing capabilities can inject malicious scripts to execute...

Grav CMS Detection (HTTP)

HTTP based detection of Grav CMS. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

Grav Input Validation Error Vulnerability

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. An input validation error vulnerability exists in the Common/Grav.php file in Grav versions prior to 1.6.23. The vulnerability stems from a web-based syst...