CVE-2022-1173

stored xss in GitHub repository getgrav/grav prior to 1.7.33...

CVE-2022-2073

Code Injection in GitHub repository getgrav/grav prior to 1.7.34...

Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin

Exploit for: GravCMS 1.10.7 - Arbitrary YAML Write/...

Arbitrary Code Execution

getgrav/grav is vulnerable to Arbitrary Code Execution. This vulnerability is due to improper validation of accessible functions through the Utils::isDangerousFunction and the lack of restrictions on twig functions like twigarraymap, allowing attackers to bypass the validation and execute arbitra...

Code Injection

getgrav/grav is vulnerable to Code Injection. The vulnerability is due to unrestricted access to the twig extension class from the Grav context within twig.php, which allows attackers to redefine the escape function and execute arbitrary commands...

Insufficient Permission Validation

getgrav/grav is vulnerable to Insufficient Permission Validation. The vulnerability is due to enabling regular users with page creation privileges to access the Frontmatter feature when the datajsonheaderform parameter is included in the POST body while creating a page. The vulnerability is also...

Server-Side Template Injection

getgrav/grav is vulnerable to Server-Side Template Injection. The vulnerability exists because it does not properly validate the denylist, which allows an attacker to execute a template injection payload by inserting a double backslash in the $name parameter...

Server-side Template Injection(SSTI)

getgrav/grav is vulnerable to Server-side Template InjectionSSTI. Malicious PHP code can be executed remotely by an authenticated attacker with page editing privileges resulting in remote code execution...

Server-Side Template Injection (SSTI)

getgrav/grav is vulnerable to Server-Side Template Injection SSTI. The vulnerability exists because the Filter function of GravExtension.php does not properly block the other built-in functions exposed by Twig's Core Extension, which allows an attacker to invoke arbitrary unsafe functions, leadin...

Remote Code Execution

getgrav/grav is vulnerable to remote code execution. An authenticated remote attacker is able to cause server side template injection via Twig which renders risky functions by default, such as system...

CVE-2022-2073

Code Injection in GitHub repository getgrav/grav prior to 1.7.34...

Code injection

Code Injection in GitHub repository getgrav/grav prior to 1.7.34...

CVE-2022-2073 Code Injection in getgrav/grav

Code Injection in GitHub repository getgrav/grav prior to 1.7.34...

CVE-2022-2073 Code Injection in getgrav/grav

Code Injection in GitHub repository getgrav/grav prior to 1.7.34...

CVE-2022-2073

CVE-2022-2073 is a Grav SSTI vulnerability in getgrav/grav prior to 1.7.34 where the Twig filter function could be abused to trigger unsafe calls. Grav patched filter() in 1.7.34, but attackers could still abuse other Twig core filters (e.g., map/reduce) to reach remote code execution unless thos...

PT-2022-14839 · Unknown · Getgrav/Grav

Name of the Vulnerable Software and Affected Versions: getgrav/grav versions prior to 1.7.34 Description: The issue concerns Server Side Template Injection via Twig, where Twig should not render dangerous functions by default, such as system. This is related to Code Injection in the GitHub...

Cross-site Scripting (XSS)

getgrav/grav is vulnerable to cross site scripting. The vulnerability exists due to lack of sanitization of regular expression in the detectXss function allowing an attacker to inject maliciously crafted script via the browser in onX events...

CVE-2022-1173

stored xss in GitHub repository getgrav/grav prior to 1.7.33...

Cross site scripting

stored xss in GitHub repository getgrav/grav prior to 1.7.33...

CVE-2022-1173

CVE-2022-1173 affects Grav CMS: stored XSS in getgrav/grav prior to 1.7.33 due to insufficient input filtering/escaping. Impact is client-side JavaScript execution. No exploitation details are provided in the public documents beyond the vulnerability description. Remediation: upgrade Grav to 1.7....