Lucene search
+L

1629 matches found

Kitploit
Kitploit
added 2026/09/13 11:24 a.m.6 views

CVE-2021-29440

CVE-2021-29440 Procesamiento Twig inseguro de páginas estáticas que conduce a RCE en Grav CMS 1.7.10 Grav es una plataforma web basada en archivos. El procesamiento Twig de páginas estáticas puede habilitarse en el front matter por cualquier usuario administrativo con permisos para crear o editar...

8.4CVSS7.5AI score0.30623EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/09/13 11:07 a.m.6 views

Grav-CMS-RCE-Authenticated

Grav CMS Remote Code Execution Autenticado - CVE-2024-28116 Información Este código es una adaptación delrepositorio de GitHub Graver con algunas mejoras basadas en este video. Exploit contra Grav CMS para versiones anteriores a 1.7.45 basado en vulnerabilidades SSTI + RCE, etiquetado como...

8.8CVSS8AI score0.0576EPSS
SaveExploits4References1
Kitploit
Kitploit
added 2026/09/13 7:59 a.m.3 views

CVE-2026-78851

Grav Authenticated Path Traversal / Arbitrary Directory Disclosure via Twig mediadirectory Reporter Name: CYBER-SEC Contact: [email protected] Summary Grav's Twig function mediadirectory is exposed inside the page-content Twig sandbox allowlist but does not properly enforce path containment...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 4:47 a.m.7 views

Graver

Graver Descripción Script de prueba de concepto para explotar la SSTI+RCE autenticada en Grav CMS CVE-2024-28116. Crea una página RCE maliciosa en el servidor que ejecuta el Grav CMS vulnerable. Referencias: https://nvd.nist.gov/vuln/detail/CVE-2024-28116 Notas Dado que es una vulnerabilidad...

8.8CVSS7.9AI score0.0576EPSS
SaveExploits4
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.59 views

Grav < 1.7 - Open Redirect

Grav before 1.7 has an open redirect vulnerability via common/Grav.php. This is partially fixed in 1.6.23 and still present in 1.6.x. id: CVE-2020-11529 info: name: Grav 1.7 - Open Redirect author: 0xAkoko severity: medium description: Grav before 1.7 has an open redirect vulnerability via...

6.1CVSS6.2AI score0.10879EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.55 views

Grav CMS <1.3.0 - Cross-Site Scripting

Grav CMS before 1.3.0 is vulnerable to cross-site scripting via system/src/Grav/Common/Twig/Twig.php and allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin/tools. id: CVE-2018-5233 info: name: Grav CMS 1.3.0 - Cross-Site Scripting author: pikpikcu severity:...

6.1CVSS6.4AI score0.03286EPSS
SaveExploits3References4
CVE
CVE
added 2026/09/13 12:00 a.m.5 views

CVE-2025-64059

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...

1.8CVSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/12 7:13 p.m.6 views

CVE-2025-50286

Grav CMS v1.7.48 / Admin Plugin v1.10.48 - RCE autenticado a través de la subida de plugins CVE-2025-50286 Grav CMS v1.7.48 con Admin Plugin v1.10.48 es vulnerable a Ejecución Remota de Código RCE a través de la función de subida de plugins "Instalación Directa", permitiendo a administradores...

8.1CVSS6AI score0.09244EPSS
SaveExploits7
Kitploit
Kitploit
added 2026/09/12 11:16 a.m.5 views

GenGravSSTIExploit

ES GenGravSSTIExploit es un script PoC en Python que explota una vulnerabilidad autenticada de inyección de plantillas del lado del servidor SSTI en Grav CMS versiones = 1.7.44 CVE-2024-28116. Esta vulnerabilidad permite a un usuario con permisos de editor ejecutar comandos del SO en un servidor...

8.8CVSS7.9AI score0.0576EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/09 6:02 p.m.6 views

grav-cve-2024-28116

CVE-2024-28116 — SSTI with Sandbox Bypass in Grav CMS Analysis and Docker reproduction of CVE-2024-28116, a Server-Side Template Injection vulnerability with security sandbox bypass in Grav CMS versions up to and including 1.7.44, fixed in version 1.7.45. Reported by: Maurizio Siddu akabe1 CVSS...

8.8CVSS7.9AI score0.0576EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/09 10:33 a.m.5 views

CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 RCE autenticada Prueba de concepto para CVE-2026-65008 : ejecución remota de código autenticada en Grav CMS mediante calluserfuncarray sin restricciones en Blueprint::dynamicData. Un usuario con admin.pages o api.pages.write puede insertar un frontmatter malicioso ...

9.8CVSS5.9AI score0.02015EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/08 12:14 p.m.5 views

CVE-2021-21425-RCE

esta es mi versión, encontré muchas en internet pero son demasiado malas USO root@kitploit: python3 exploit.py -u http://IP/grav-admin/ --lhost YOUR TUN0 IP --lport 4444 espera... en 60 segundos obtendrás una shell en tu listener...

9.8CVSS8.1AI score0.806EPSS
SaveExploits12
Kitploit
Kitploit
added 2026/09/06 6:39 p.m.6 views

CVE-2025-50286

Grav Admin Direct Install RCE CVE-2025-50286 Módulo de Metasploit y configuración de laboratorio para ejecución remota de código autenticada en la funcionalidad de instalación directa del plugin Grav Admin. Resumen CVE: CVE-2025-50286 Impacto: RCE autenticado Vector: Panel de administración →...

8.1CVSS6.1AI score0.09244EPSS
SaveExploits7
NVD
NVD
added 2026/09/05 1:18 p.m.6 views

CVE-2026-86197

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

5.1CVSS0.00257EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/05 1:18 p.m.8 views

CVE-2026-86193

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative...

8.7CVSS0.00215EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/05 1:18 p.m.9 views

CVE-2026-86195

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...

8.7CVSS0.00228EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/05 1:18 p.m.6 views

CVE-2026-86194

Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save,...

6.9CVSS0.00323EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/05 1:18 p.m.7 views

CVE-2026-86196

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious...

8.7CVSS0.00257EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/05 12:09 p.m.6 views

EUVD-2026-71999

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

5.1CVSS5.8AI score0.00257EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/05 12:09 p.m.13 views

CVE-2026-86197

Grav versions before 2.0.20 contain a cross-site scripting (XSS) vulnerability in the Twig sandbox policy . The addJs and addCss methods on Grav\Common\Assets are allowlisted without proper output escaping, allowing page editors to inject arbitrary script by registering malicious assets or inject...

5.1CVSS5.8AI score0.00257EPSS
SaveExploits0References2
Rows per page
Query Builder