97 matches found
Cross site scripting
Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...
CVE-2022-0268
Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...
CVE-2022-0268
CVE-2022-0268 is an XSS vulnerability in Grav prior to 1.7.28, stored in Packagist getgrav/grav. Root cause: insufficient input validation/escaping allows a low-privilege user to inject arbitrary JavaScript when creating a page. Affects Grav versions
CVE-2022-0268 Cross-site Scripting (XSS) - Stored in getgrav/grav
Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...
CVE-2022-0268 Cross-site Scripting (XSS) - Stored in getgrav/grav
Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...
CVE-2022-0268: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting XSS - Stored in Packagist getgrav/grav prior to 1.7.28...
Cross-site Scripting (XSS) - Stored in getgrav/grav
Description Stored XSS is a vulnerability in which the attacker can execute arbitrary javascript code in the victim's browser. The XSS payload is stored in a webpage and it gets executed whenever someone visits that webpage. I used &58 instead of : in the href attribute of tag to bypass the xss...
Path Traversal
getgrav/grav is vulnerable to path traversal. An attacker can traverse the file system to access files or directories when using bin/grav server...
CVE-2021-3924 Path Traversal in getgrav/grav
grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to cross-site scripting. This is due to improper encoding of the tags, which allows an attacker to insert and execute malicious javascript...
CVE-2021-3904 Cross-site Scripting (XSS) - Stored in getgrav/grav
grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
Cookies Validation Bypass
getgrav/grav is vulnerable to cookies validation bypass. Setting cookies to be accessible from the root context path using Session::setFlashCookieObject exposes the cookie to all web applications on the domain...
in getgrav/grav-plugin-admin
āļø Description It can be possible to perform a clickjacking attack due to the lack of frame restrictions. The application does not set the response header X-Frame-Options: DENY. šµļøāāļø Proof of Concept š„ Impact According to PortSwigger references, it is possible for a page controlled by an attacker...
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to cross-site scripting XSS. A user with the ability to edit pages is able to inject and execute malicious code due to insecure default security configuration when using Admin plugin to edit pages...
Open Redirect
getgrav/grav is vulnerable to open redirect. The vulnerability exists because the function redirect in Common/Grav.php does not validate the internal route parameter route and redirect to another location, allowing attackers to provide a malicious route to a location or file...
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to cross-site scripting XSS attacks. During uploading of a new avatar, parameters sent via SVG files are not sanitized, allowing an attacker to inject arbitrary Javascript into a victim's browser...
learn.getgrav.org XSS vulnerability
Open Bug Bounty ID: OBB-506496 Description| Value ---|--- Affected Website:| learn.getgrav.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...