105495 matches found
CVE-2026-85603
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...
CVE-2026-85601
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
CVE-2026-85600
Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...
CVE-2026-85589
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...
CVE-2026-85587
phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...
EUVD-2026-71026
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...
CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...
CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...
CVE-2026-85603
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action. The root cause is a missing validation of the language code (lang) POST field, allowing an authenticated user with the admin.pages.create permission to inject directory traversal sequences. T...
CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
EUVD-2026-71024
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
CVE-2026-85601
Grav Admin versions before 2.0.20 contain a cross-site scripting (XSS) vulnerability in the MarkdownEditor and MarkdownModal components. The root cause is unsanitized output from marked.parse() being injected into the DOM via Svelte's {@html} directive. Attackers can exploit this by injecting jav...
CVE-2026-85600
Grav Admin (getgrav/grav-plugin-admin2) versions ≤ 2.0.19 contain a stored XSS vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts). The function substitutes untrusted parameters—such as usernames—into translation templates before parsing the result as markdown. Grav's server-sid...
CVE-2026-85600 Grav Admin before 2.0.21 Stored XSS via username
Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...
CVE-2026-85600 Grav Admin before 2.0.21 Stored XSS via username
Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...
CVE-2026-85600 Grav Admin before 2.0.21 Stored XSS via username
Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...
EUVD-2026-71023
Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...
EUVD-2026-71012
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...