Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the dynamicData function. An attacker can execute arbitrary code by planting a malicious callable directive in a...

CVE-2026-65008

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...

CVE-2026-65008 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...

CVE-2026-65008

Grav 2.0.4 contains a remote code execution vulnerability in Blueprint::dynamicData(), where a Class::method callable string and arguments are passed to call_user_func_array() without an allowlist. The form plugin routes page frontmatter through this path, allowing an authenticated user with admi...

CVE-2026-65008 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...

PT-2025-37038

Name of the Vulnerable Software and Affected Versions: AxxonSoft Axxon One VMS versions 2.0.0 through 2.0.4 Description: The software uses unmaintained third-party components in its NuGet dependencies. This allows a remote attacker to execute arbitrary code or bypass security features by exploiti...

[SECURITY] Fedora 38 Update: R-jsonlite-1.8.5-2.fc38

A reasonably fast JSON parser and generator, optimized for statistical data a nd the web. Offers simple, flexible tools for working with JSON in R, and is particularly powerful for building pipelines and interacting with a web API. The implementation is based on the mapping described in the...

DynamicData(dms)Document&Article Script /dm_browse.asp.asp sql injection

DynamicDatadmsDocument&Article Script /dmbrowse.asp.asp sql injection Credit : CodeXpLoder'tq mail : codexploderathotmaildotcom site : Biyosecurity.net,expw0rm.com thx : BiyoSecurityTeam all members thx 3APA3A spec.note : "Live The Life" 1- example.com/patch/dmbrowse.asp?pid=sql methot 1-...