CVE-2026-62668

Grav API Plugin (RESTful API for Grav CMS) prior to 1.0.6 is vulnerable to SSRF via unrestricted cURL protocols in webhook dispatch. The WebhookController.php accepts webhook URLs with only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS...

CVE-2026-62668 Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTERVALIDATEURL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPTPROTOCO...

EUVD-2026-62538

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTERVALIDATEURL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPTPROTOCO...

EUVD-2026-62537

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

CVE-2026-62670 Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

CVE-2026-62670

CVE-2026-62670 is a fail-open authorization flaw in the Grav Flex Objects Plugin (by Trilby Media) prior to version 1.4.3 . The requireFlexPermission() method in classes/Api/FlexApiController.php (Admin Next API) returns without denying access when a directory blueprint omits config.admin.permiss...

CVE-2026-61607

In Grav API plugin versions prior to 1.0.2, HandlesMediaUploads::processUploadedFile() validates only the SVG filename extension without calling Security::sanitizeSVG(), allowing an attacker with api.media.write permission to upload an SVG with embedded JavaScript. The server serves it as Content...

CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

EUVD-2026-62533

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

CVE-2026-75951

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-75951

J-BusinessDirectory extension (versions before 6.2.3) contains an Insecure Direct Object Reference flaw across multiple frontend/API actions, allowing unauthenticated remote attackers to access or modify other users' data; CVSS 6.9 (Medium). Remediation is to upgrade to version 6.2.3 or later. No...

CVE-2026-75951 Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

EUVD-2026-62492

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

CVE-2026-76215

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

CVE-2026-76209

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST...

CVE-2026-76211

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATIONEDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind...

CVE-2026-76215

phpMyFAQ before 4.1.7 contains an authorization bypass in its comments and attachments API endpoints. The application fails to enforce parent FAQ visibility checks before returning child resources, allowing unauthenticated attackers to retrieve restricted comment text, commenter email addresses, ...

CVE-2026-76215 phpMyFAQ before 4.1.7 Missing Authorization via child resources

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

EUVD-2026-62456

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...