Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting

Exploit Title: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting Date: 13-12-2020 Exploit Author: Sagar Banwa Vendor Homepage: https://getgrav.org/ Software Link: https://getgrav.org/downloads Version: Grav v1.6.30 - Admin v1.9.18 Tested on: Windows 10/Kali Linux...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS. A user with the ability to edit pages is able to inject and execute malicious code due to insecure default security configuration when using Admin plugin to edit pages...

Cross-Site Scripting in Grav

Impact Privileged users with the ability to edit pages have a mechanism to perform remote code execution via XSS. At a minimum, the vulnerability represents a bypass of security controls put in place to mitigate this form of attack. The remote code execution can be performed because XSS would all...

Grav CMS Detection (HTTP)

HTTP based detection of Grav CMS. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

Grav Input Validation Error Vulnerability

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. An input validation error vulnerability exists in the Common/Grav.php file in Grav versions prior to 1.6.23. The vulnerability stems from a web-based syst...

Open Redirect

getgrav/grav is vulnerable to open redirect. The vulnerability exists because the function redirect in Common/Grav.php does not validate the internal route parameter route and redirect to another location, allowing attackers to provide a malicious route to a location or file...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

Open redirect

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...

CVE-2020-11529

Grav before 1.7 has an open redirect in Common/Grav.php. The issue is partially fixed in 1.6.23 but remains in 1.6.x; Grav 1.7+ is affected by the resolved behavior. Nuclei and Veracode entries describe the risk as open redirect that can redirect users to a malicious site (phishing). Practical im...

GHSA-6268-V434-45M5 Cross-site Scripting in Grav

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

Cross-site Scripting in Grav

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS attacks. During uploading of a new avatar, parameters sent via SVG files are not sanitized, allowing an attacker to inject arbitrary Javascript into a victim's browser...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

Cross site scripting

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-16126

CVE-2019-16126 affects Grav up to 1.6.15 and describes a Stored Cross-Site Scripting (XSS) vulnerability caused by JavaScript execution in SVG images. The cited sources consistently indicate that uploading or handling SVG content can lead to arbitrary script execution in a victim’s browser, enabl...

Grav CMS 1.2.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications CVE-2018-5233 Grav CMS admin plugin Reflected Cross Site Scripting XSS vulnerability Description Grav CMS is a flat-file CMS using Markdown files for content management Official Website. It has been elected "Best Open Source CMS of 2016" by CM...