CVE-2021-21425-RCE

this is my version i found a lot in internet but those are too bad USAGE python3 exploit.py -u http://IP/grav-admin/ --lhost YOUR TUN0 IP --lport 4444 wait.. for 60sec you will get shell at your listener...

CVE-2025-50286

Grav Admin Direct Install RCE CVE-2025-50286 Metasploit module and lab setup for authenticated Remote Code Execution in the Grav Admin Plugin Direct Install functionality. Overview CVE: CVE-2025-50286 Impact: Authenticated RCE Vector: Admin panel → Direct Install Result: Arbitrary command executi...

CVE-2026-85601

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-85600

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...

CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...

CVE-2026-85601

Grav Admin versions before 2.0.20 contain a cross-site scripting (XSS) vulnerability in the MarkdownEditor and MarkdownModal components. The root cause is unsanitized output from marked.parse() being injected into the DOM via Svelte's {@html} directive. Attackers can exploit this by injecting jav...

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

EUVD-2026-71024

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-85600

Grav Admin (getgrav/grav-plugin-admin2) versions ≤ 2.0.19 contain a stored XSS vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts). The function substitutes untrusted parameters—such as usernames—into translation templates before parsing the result as markdown. Grav's server-sid...

CVE-2026-85600

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

CVE-2026-85600 Grav Admin before 2.0.21 Stored XSS via username

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

EUVD-2026-71023

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

CVE-2026-85600 Grav Admin before 2.0.21 Stored XSS via username

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

CVE-2026-85600 Grav Admin before 2.0.21 Stored XSS via username

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

PT-2026-85501

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-85601: Improper Neutralization of Input During Web Page Generation

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

PT-2026-85500

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...