CVE-2022-1173

CVE-2022-1173 affects Grav CMS: stored XSS in getgrav/grav prior to 1.7.33 due to insufficient input filtering/escaping. Impact is client-side JavaScript execution. No exploitation details are provided in the public documents beyond the vulnerability description. Remediation: upgrade Grav to 1.7....

CVE-2022-1173

stored xss in GitHub repository getgrav/grav prior to 1.7.33...

CVE-2022-1173: Improper Neutralization of Input During Web Page Generation

stored xss in GitHub repository getgrav/grav prior to 1.7.33...

PT-2022-13690

Name of the Vulnerable Software and Affected Versions getgrav/grav versions prior to 1.7.33 Description The issue is related to stored cross-site scripting XSS in the GitHub repository getgrav/grav. Recommendations For versions prior to 1.7.33, update to version 1.7.33 or later to resolve the iss...

Grav 跨站脚本漏洞

Grav is a scalable CMS content management system for personal blogs, small content publishing platforms, and single-page product displays. cross-site scripting vulnerabilities exist in versions prior to Grav 1.7.33, which stem from the application's lack of filtering and escaping of user data. An...

Server Side Template Injection

Description Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system. PoC video. Proof of Concept Payload: 'cat\x20/etc/passwd'|filter'system' 1. With an authenticated user,...

Grav Cross-Site Scripting Vulnerability (CNVD-2022-20517)

Grav is a scalable CMS content management system for personal blogs, small content publishing platforms, and single-page product displays. cross-site scripting vulnerabilities exist in versions prior to Grav 1.7.31, which stem from the program's lack of data validation filtering of user-supplied...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to stored cross-site scripting. The vulnerability exists due to lack of xss validations for uploaded SVG files before they get stored which allows an attacker to inject and execute arbitrary javascript...

GHSA-R6HH-5G3Q-WWGC Stored Cross-site Scripting in grav

Grav prior to 1.7.31 is vulnerable to stored cross-site scripting...

Stored Cross-site Scripting in grav

Grav prior to 1.7.31 is vulnerable to stored cross-site scripting...

The grav application allows large characters to insert in the input field "Full Name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request

Proof of Concept: 1. Go to http://site/admin/accounts/users/testuser 2. There will a Full name input field 3. Add more than 1 lakhs+ characters to the Full name field 4. You will see the application accepts large characters and if we will increase the characters then it can lead to Dos. POC Image...

CVE-2022-0970

Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...

CVE-2022-0970

Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...

CVE-2022-0970

CVE-2022-0970 concerns Grav CMS (getgrav/grav). The vulnerability is a stored cross-site scripting issue in Grav prior to 1.7.31 caused by lack of proper data validation/filtering of user-supplied data and output, enabling JavaScript execution on the client side. The available connected documenta...

CVE-2022-0970

Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...

CVE-2022-0970 Cross-site Scripting (XSS) - Stored in getgrav/grav

Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...

CVE-2022-0970: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...

PT-2022-13569

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.31 Description The issue is related to stored Cross-site Scripting XSS, which occurs when an application stores user input and later displays it without proper validation or escaping, allowing an attacker to inject...

Grav 跨站脚本漏洞

Grav is a scalable CMS content management system for personal blogs, small content publishing platforms, and single-page product displays. cross-site scripting vulnerabilities exist in versions prior to Grav 1.7.31, which stem from the program's lack of data validation filtering of user-supplied...