1673 matches found
CVE-2020-29556
The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...
Grav 跨站请求伪造漏洞
Grav is a flat file CMS that uses Markdown files for content management. A cross-site request forgery vulnerability exists in the scheduler in Grav 1.7.0-rc.17 and earlier versions. An attacker can exploit this vulnerability to execute system commands by tricking an administrator into visiting a...
Grav 路径遍历漏洞
Grav is a flat file CMS that uses Markdown files for content management. A path traversal vulnerability exists in the backup feature of Grav 1.7.0-rc.17 and earlier versions. An attacker can exploit this vulnerability to read arbitrary local files on the underlying server...
Grav 路径遍历漏洞
Grav is a flat file CMS that uses Markdown files for content management. An arbitrary file deletion vulnerability exists in the BackupDelete feature of Grav 1.7.0-rc.17 and earlier versions. An attacker can exploit this vulnerability by using path traversal techniques to delete arbitrary files on...
Grav CMS 1.6.30 Cross Site Scripting
Exploit Title: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting Date: 13-12-2020 Exploit Author: Sagar Banwa Vendor Homepage: https://getgrav.org/ Software Link: https://getgrav.org/downloads Version: Grav v1.6.30 - Admin v1.9.18 Tested on: Windows 10/Kali Linux...
Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting
Exploit Title: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting Date: 13-12-2020 Exploit Author: Sagar Banwa Vendor Homepage: https://getgrav.org/ Software Link: https://getgrav.org/downloads Version: Grav v1.6.30 - Admin v1.9.18 Tested on: Windows 10/Kali Linux...
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to cross-site scripting XSS. A user with the ability to edit pages is able to inject and execute malicious code due to insecure default security configuration when using Admin plugin to edit pages...
Cross-Site Scripting in Grav
Impact Privileged users with the ability to edit pages have a mechanism to perform remote code execution via XSS. At a minimum, the vulnerability represents a bypass of security controls put in place to mitigate this form of attack. The remote code execution can be performed because XSS would all...
Grav CMS Detection (HTTP)
HTTP based detection of Grav CMS. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...
Grav Input Validation Error Vulnerability
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms and one-page product presentations. An input validation error vulnerability exists in the Common/Grav.php file in Grav versions prior to 1.6.23. The vulnerability stems from a web-based syst...
Open Redirect
getgrav/grav is vulnerable to open redirect. The vulnerability exists because the function redirect in Common/Grav.php does not validate the internal route parameter route and redirect to another location, allowing attackers to provide a malicious route to a location or file...
CVE-2020-11529
Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...
CVE-2020-11529
Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...
Open redirect
Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...
CVE-2020-11529
Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x...
CVE-2020-11529
Grav before 1.7 has an open redirect in Common/Grav.php. The issue is partially fixed in 1.6.23 but remains in 1.6.x; Grav 1.7+ is affected by the resolved behavior. Nuclei and Veracode entries describe the risk as open redirect that can redirect users to a malicious site (phishing). Practical im...
Cross-site Scripting in Grav
Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...
GHSA-6268-V434-45M5 Cross-site Scripting in Grav
Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to cross-site scripting XSS attacks. During uploading of a new avatar, parameters sent via SVG files are not sanitized, allowing an attacker to inject arbitrary Javascript into a victim's browser...