GHSA-2P89-PPC2-MRQ4 Cross site scripting in getgrav/grav

User input is not properly sanitized leading to cross site scrpting xss in grav...

Cross site scripting in getgrav/grav

User input is not properly sanitized leading to cross site scrpting xss in grav...

CVE-2022-0743

Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...

CVE-2022-0743 Cross-site Scripting (XSS) - Stored in getgrav/grav

Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...

CVE-2022-0743

Summary: CVE-2022-0743 is a stored XSS vulnerability in the Grav CMS (GitHub repo getgrav/grav) affecting versions prior to 1.7.31. The issue arises from insufficient input validation/output handling that allows injected scripts to be stored and later executed by users. Public references (NVD, Re...

CVE-2022-0743 Cross-site Scripting (XSS) - Stored in getgrav/grav

Cross-site Scripting XSS - Stored in GitHub repository getgrav/grav prior to 1.7.31...

Cross-site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS attacks. Insufficient checks in detectXss allow remote attackers to inject and execute arbitrary javascript code in the victim's browser...

CVE-2022-0268

Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...

CVE-2022-0268

Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...

Cross site scripting

Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...

CVE-2022-0268

CVE-2022-0268 is an XSS vulnerability in Grav prior to 1.7.28, stored in Packagist getgrav/grav. Root cause: insufficient input validation/escaping allows a low-privilege user to inject arbitrary JavaScript when creating a page. Affects Grav versions

CVE-2022-0268 Cross-site Scripting (XSS) - Stored in getgrav/grav

Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...

CVE-2022-0268 Cross-site Scripting (XSS) - Stored in getgrav/grav

Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...

Cross-site Scripting (XSS) - Stored in getgrav/grav

Description Stored XSS is a vulnerability in which the attacker can execute arbitrary javascript code in the victim's browser. The XSS payload is stored in a webpage and it gets executed whenever someone visits that webpage. I used &58 instead of : in the href attribute of tag to bypass the xss...

Path Traversal

getgrav/grav is vulnerable to path traversal. An attacker can traverse the file system to access files or directories when using bin/grav server...

CVE-2021-3924 Path Traversal in getgrav/grav

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting. This is due to improper encoding of the tags, which allows an attacker to insert and execute malicious javascript...

CVE-2021-3904 Cross-site Scripting (XSS) - Stored in getgrav/grav

grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cookies Validation Bypass

getgrav/grav is vulnerable to cookies validation bypass. Setting cookies to be accessible from the root context path using Session::setFlashCookieObject exposes the cookie to all web applications on the domain...

in getgrav/grav-plugin-admin

✍️ Description It can be possible to perform a clickjacking attack due to the lack of frame restrictions. The application does not set the response header X-Frame-Options: DENY. 🕵️‍♂️ Proof of Concept 💥 Impact According to PortSwigger references, it is possible for a page controlled by an attacker...