Graver

Graver 描述 针对 Grav CMS 中已认证的 SSTI+RCE 漏洞（CVE-2024-28116）的概念验证（PoC）脚本。 该脚本会在运行存在漏洞的 Grav CMS 的服务器上创建一个恶意的 RCE 页面。 参考： https://nvd.nist.gov/vuln/detail/CVE-2024-28116 备注 由于这是一个已认证漏洞，因此需要使用 Grav CMS 编辑者用户的有效凭据（在脚本中硬编码这些凭据）。 用法 以下是该工具的一个使用示例： python3 graver.py -t -p 包含返回输出的简单示例： python3 graver.py -t...

GenGravSSTIExploit

英文 GenGravSSTIExploit 是一个 PoC Python 脚本，利用 Grav CMS 版本 -p ：目标 URL，格式为 https://hostname。 ：端口号（默认为 80）。 示例： python GenGravSSTIExploit.py -t http://example.com -p 8080 4. 与 Exploit 交互 如果利用成功，你会获得一个可以执行操作系统命令的 URL： + RCE payload injected. Visit the malicious page: http://example.com:8080/poc?do= 示例输出...

CVE-2025-50286

Grav CMS v1.7.48 / Admin Plugin v1.10.48 - 通过插件上传实现的认证 RCE（CVE-2025-50286） Grav CMS v1.7.48 配合 Admin Plugin v1.10.48 存在通过“Direct Install”插件上传功能触发的远程代码执行（RCE）漏洞，允许已认证的管理员在服务器上执行任意 PHP 代码。 CVE 编号 CVE-2025-50286 概述 类型： 认证远程代码执行（RCE） 位置： /admin/tools/direct-install（管理面板 工具 直接安装） 影响： 任意 PHP...

grav-cve-2024-28116

CVE-2024-28116 — Grav CMS 中的 SSTI 与沙箱绕过 对 CVE-2024-28116 的分析与 Docker 复现。该漏洞是 Grav CMS 1.7.44 及更早版本中的一个服务端模板注入（SSTI）漏洞，可绕过安全沙箱，已在 1.7.45 版本中修复。 报告者：Maurizio Siddu akabe1 CVSS v3.1 评分：8.8（高危） 修复版本：Grav CMS 1.7.45 仓库结构 vulnerable Dockerfile Grav CMS 1.7.44（存在漏洞） apache.conf Apache 配置 patched...

CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 认证 RCE CVE-2026-65008 的概念验证：通过 Blueprint::dynamicData 中不受限制的 calluserfuncarray，在 Grav CMS 中实现认证远程代码执行。 拥有 admin.pages（或 api.pages.write）权限的用户可以植入恶意表单 frontmatter。当任何 访客（包括未认证用户）加载页面时，该载荷将以 Web 服务器用户身份执行。 仅限授权测试。 仅可用于您拥有或已获得明确书面许可进行测试的系统。 致谢 角色| ---|--- 漏洞报告者|...

CVE-2021-21425-RCE

这是我自己的版本，我在网上找到了很多，但那些都很糟糕。 用法 python3 exploit.py -u http://IP/grav-admin/ --lhost YOUR TUN0 IP --lport 4444 等待.. 60秒后你将在监听器上获得shell。...

Grav-CMS-RCE-Authenticated

Grav CMS リモートコード実行 認証済み - CVE-2024-28116 情報 このコードは、このビデオに基づいて改良を加えた、Graver Githubリポジトリからの翻案です。 Grav CMS（1.7.45未満のバージョン）に対するエクスプロイトで、SSTI + RCEの脆弱性（CVE-2024-28116として識別）に基づきます。このスクリプトは基本的に、脆弱性を含むページを作成し、実行し、最後に実行後にそのページを削除します。 使い方 python3 GravCMSRCE.py -t http://10.10.10.10 -u 'admin' -p...

CVE-2021-29440

CVE-2021-29440 Grav CMS 1.7.10 中对静态页面的不安全 Twig 处理导致 RCE Grav 是一个基于文件的 Web 平台。任何获准创建或编辑页面的管理用户都可以在 front matter 中启用对静态页面的 Twig 处理。由于 Twig 处理器在无沙箱环境下运行，这种行为可被利用来实现任意代码执行并提升实例上的权限。 说明 你需要一个有权访问 /admin 仪表盘并拥有页面创建权限的用户。 front matter 块支持一个名为 process.twig 的指令，该指令会在页面被提供之前对内容执行一次 Twig 渲染处理。...

CVE-2026-100670

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CVE-2026-100672

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100667

grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...

CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

EUVD-2026-87766

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100672

The Comments plugin (getgrav/grav-plugin-comments ) for Grav CMS through version 1.2.10 contains an authentication bypass that allows for unauthenticated information disclosure . The root cause is an admin handler that incorrectly uses the isAdmin() function, which only verifies if the admin serv...

EUVD-2026-87764

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CVE-2026-100670

Grav CMS versions 2.0.14 through 2.0.24 are vulnerable to a privilege escalation vulnerability within the group and account blueprints. The root cause is a flaw where the access map guard (e.g., security@: admin.super) resolves by exact path; consequently, a flat dot-notation key like access.admi...

CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...