Open Redirect

getgrav/grav is vulnerable to open redirect. The vulnerability exists because the function redirect in Common/Grav.php does not validate the internal route parameter route and redirect to another location, allowing attackers to provide a malicious route to a location or file...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

Open redirect

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Grav before 1.7 has an open redirect in Common/Grav.php. The issue is partially fixed in 1.6.23 but remains in 1.6.x; Grav 1.7+ is affected by the resolved behavior. Nuclei and Veracode entries describe the risk as open redirect that can redirect users to a malicious site (phishing). Practical im...

PT-2020-12666

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7 Grav versions 1.6.x except 1.6.23 and later Description The issue is related to an Open Redirect in the Common/Grav.php file. This problem is partially fixed in version 1.6.23 but still exists in other 1.6.x versions...

CVE-2020-11529: URL Redirection to Untrusted Site

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

GHSA-6268-V434-45M5 Cross-site Scripting in Grav

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

Cross-site Scripting in Grav

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS attacks. During uploading of a new avatar, parameters sent via SVG files are not sanitized, allowing an attacker to inject arbitrary Javascript into a victim's browser...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

Cross site scripting

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126

CVE-2019-16126 affects Grav up to 1.6.15 and describes a Stored Cross-Site Scripting (XSS) vulnerability caused by JavaScript execution in SVG images. The cited sources consistently indicate that uploading or handling SVG content can lead to arbitrary script execution in a victim’s browser, enabl...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126: Improper Neutralization of Input During Web Page Generation

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

PT-2019-14528

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.6.16 Description The issue allows for Stored Cross-Site Scripting due to JavaScript execution in SVG images. Recommendations For Grav versions prior to 1.6.16, update to version 1.6.16 or later to resolve the issue...