Cross-site Scripting (XSS) - Stored in getgrav/grav

Description Grav is vulnerable to XSS. It is possible to use instead of : in tags. Proof of Concept Payload: HTML CLICK HERE 1: Edit a page with the payload user with low privileges. 2: Check out the target page and click on CLICK HERE. PoC video. Impact This vulnerability is capable of executing...

Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications c...

GHSA-CG3Q-59W7-RVC2 Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications c...

Grav Access Control Error Vulnerability

Grav is a scalable CMS content management system for personal blogs, small content publishing platforms and single-page product displays. grav contains an access control error vulnerability that stems from the product's lack of validation of cookies and integrity checks. No detailed vulnerability...

Cookies Validation Bypass

getgrav/grav is vulnerable to cookies validation bypass. Setting cookies to be accessible from the root context path using Session::setFlashCookieObject exposes the cookie to all web applications on the domain...

CVE-2021-3799

grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames...

CVE-2021-3818

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking...

CVE-2021-3818

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking...

Input validation

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking...

CVE-2021-3799

grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames...

Input validation

grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames...

CVE-2021-3818

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking...

CVE-2021-3818

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking...

CVE-2021-3818 Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking...

CVE-2021-3818

CVE-2021-3818 : Grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. The connected sources confirm the issue stems from Grav’s handling of cookies without proper validation and integrity checks, with a documented risk example noting that a cookie with an overly bro...

CVE-2021-3799

CVE-2021-3799 relates to grav-plugin-admin, where the vulnerability arises from improper restriction of rendered UI layers or frames. The connected documents consistently describe an admin UI access-control/UI-layer restriction flaw that can enable clickjacking due to missing frame protection hea...

CVE-2021-3799 Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin

grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames...

CVE-2021-3799

grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames...

PT-2021-21937

Name of the Vulnerable Software and Affected Versions: grav-plugin-admin affected versions not specified Description: The issue is related to Improper Restriction of Rendered UI Layers or Frames. No information is provided about the estimated number of potentially affected devices worldwide or...

Grav-Plugin-Admin 访问控制错误漏洞

Grav-Plugin-Admin is an admin plugin. It is used to configure Grave pages. An Access Control Error vulnerability exists in grav-plugin-admin that stems from improper restrictions in the product's UI layer and framework...