Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS. A user with the ability to edit pages is able to inject and execute malicious code due to insecure default security configuration when using Admin plugin to edit pages...

Open Redirect

getgrav/grav is vulnerable to open redirect. The vulnerability exists because the function redirect in Common/Grav.php does not validate the internal route parameter route and redirect to another location, allowing attackers to provide a malicious route to a location or file...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS attacks. During uploading of a new avatar, parameters sent via SVG files are not sanitized, allowing an attacker to inject arbitrary Javascript into a victim's browser...

learn.getgrav.org XSS vulnerability

Open Bug Bounty ID: OBB-506496 Description| Value ---|--- Affected Website:| learn.getgrav.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...