CVE-2021-3924 Path Traversal in getgrav/grav

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting. This is due to improper encoding of the tags, which allows an attacker to insert and execute malicious javascript...

CVE-2021-3904 Cross-site Scripting (XSS) - Stored in getgrav/grav

grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cookies Validation Bypass

getgrav/grav is vulnerable to cookies validation bypass. Setting cookies to be accessible from the root context path using Session::setFlashCookieObject exposes the cookie to all web applications on the domain...

in getgrav/grav-plugin-admin

✍️ Description It can be possible to perform a clickjacking attack due to the lack of frame restrictions. The application does not set the response header X-Frame-Options: DENY. 🕵️‍♂️ Proof of Concept 💥 Impact According to PortSwigger references, it is possible for a page controlled by an attacker...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS. A user with the ability to edit pages is able to inject and execute malicious code due to insecure default security configuration when using Admin plugin to edit pages...

Open Redirect

getgrav/grav is vulnerable to open redirect. The vulnerability exists because the function redirect in Common/Grav.php does not validate the internal route parameter route and redirect to another location, allowing attackers to provide a malicious route to a location or file...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS attacks. During uploading of a new avatar, parameters sent via SVG files are not sanitized, allowing an attacker to inject arbitrary Javascript into a victim's browser...

learn.getgrav.org XSS vulnerability

Open Bug Bounty ID: OBB-506496 Description| Value ---|--- Affected Website:| learn.getgrav.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...