434 matches found
Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE
This module exploits a Server-Side Template Injection SSTI vulnerability CVE-2025-66294 in Grav CMS that allows bypassing the Twig sandbox to achieve remote code execution. The cleanDangerousTwig method uses weak regex that fails to sanitize nested Twig calls within the evaluatetwig function. To...
Grav 安全漏洞
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. Grav suffers from a user enumeration and email disclosure vulnerability that can be exploited by attackers to enumerate users and disclose sensitive email...
PT-2025-48571
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.11.0-beta.1 Description The Grav admin plugin, an HTML user interface for configuring Grav and managing pages, contains a Stored Cross-Site Scripting XSS issue. The vulnerability exists in the...
Grav CMS Cross-Site Scripting Vulnerability
Grav CMS is a modern, lightweight content management system CMS with a file-driven architecture that runs without relying on traditional databases. Grav CMS suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplie...
CVE-2025-63593
Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting XSS...
CVE-2025-63593
Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting XSS...
CVE-2025-63593
Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting XSS...
CVE-2025-63593
Grav CMS 1.7.49.5 is reported as vulnerable to Cross-Site Scripting (XSS). The CNVD/Red Hat/NVD entries describe an XSS that arises from insufficient filtering/escaping of user-supplied data, enabling execution of arbitrary scripts in a user’s browser. The XSS affects Grav’s input handling and is...
PT-2025-44792
Name of the Vulnerable Software and Affected Versions Grav CMS version 1.7.49.5 Description Grav CMS version 1.7.49.5 is susceptible to Cross Site Scripting XSS. This allows for the injection of malicious scripts into web pages viewed by other users. Recommendations At the moment, there is no...
EUVD-2022-3820
Malicious code in bioql PyPI...
EUVD-2024-0998
Malicious code in bioql PyPI...
EUVD-2022-3986
Malicious code in bioql PyPI...
EUVD-2022-5083
Malicious code in bioql PyPI...
EUVD-2023-1781
Malicious code in bioql PyPI...
EUVD-2023-1902
Malicious code in bioql PyPI...
EUVD-2025-23842
Malicious code in bioql PyPI...
EUVD-2024-0910
Malicious code in bioql PyPI...
Grav CMS Remote Code Execution Vulnerability
Grav CMS is Grav open source a flat file-based content management system . Grav CMS suffers from a remote code execution vulnerability that originates from allowing authenticated administrators to upload malicious plugins via the admin/tools/direct-install interface, which can be exploited by an...
📄 Grav CMS 1.7.48 Remote Code Execution
Grav CMS version 1.7.48 suffers from a remote code execution vulnerability. Exploit Title: Grav CMS 1.7.48 - Remote Code Execution RCE Date: 2025-08-07 Exploit Author: binneko https://github.com/binneko Vendor Homepage: https://getgrav.org/ Software Link:...
Grav CMS 1.7.48 - Remote Code Execution (RCE)
Exploit Title: Grav CMS 1.7.48 - Remote Code Execution RCE Date: 2025-08-07 Exploit Author: binneko https://github.com/binneko Vendor Homepage: https://getgrav.org/ Software Link: https://github.com/getgrav/grav/releases/tag/1.7.48 Version: Grav CMS v1.7.48 / Admin Plugin v1.10.48 Tested on: Debi...