1795 matches found
CVE-2021-3924
CVE-2021-3924 affects Grav (getgrav/grav) and is caused by an improper limitation of a pathname to a restricted directory (path traversal). The vulnerability is in the path handling logic of Grav, allowing access to files or directories outside the intended scope. Multiple connected sources confi...
Grav 路径遍历漏洞
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product presentations. A path traversal vulnerability exists in grav, which stems from an improper restriction of pathnames to restricted directories in the affected product...
Cross-Site Scripting in grav
grav prior to version 1.7.24 is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
GHSA-5JXC-HMQF-3F73 Cross-Site Scripting in grav
grav prior to version 1.7.24 is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin
Description In Grav, you can preview the file you uploaded by hovering your mouse to the file and clicking the info icon. The normal preview should be like this: However, I noticed that it is possible to perform XSS on the filename due to the following HTML Code: We can upload a file with a...
CVE-2021-3904
grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2021-3904
grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
Cross site scripting
grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2021-3904 Cross-site Scripting (XSS) - Stored in getgrav/grav
grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2021-3904
CVE-2021-3904 affects Grav (getgrav/grav) and is a Cross-Site Scripting vulnerability caused by improper input neutralization during web page generation. Multiple sources (including GHSA, Red Hat, NVD, OSV, and CVE CVELIST entries) describe it as XSS with Grav versions prior to 1.7.24 being affec...
Grav 跨站脚本漏洞
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product presentations. A cross-site scripting vulnerability exists in grav, which stems from the vulnerability of grav to incorrect input neutralization "cross-site scripting"...
Cross-site Scripting (XSS) - Stored in getgrav/grav
Description Grav is vulnerable to XSS. It is possible to use instead of : in tags. Proof of Concept Payload: HTML CLICK HERE 1: Edit a page with the payload user with low privileges. 2: Check out the target page and click on CLICK HERE. PoC video. Impact This vulnerability is capable of executing...
Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications c...
GHSA-CG3Q-59W7-RVC2 Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications c...
Grav Access Control Error Vulnerability
Grav is a scalable CMS content management system for personal blogs, small content publishing platforms and single-page product displays. grav contains an access control error vulnerability that stems from the product's lack of validation of cookies and integrity checks. No detailed vulnerability...
Cookies Validation Bypass
getgrav/grav is vulnerable to cookies validation bypass. Setting cookies to be accessible from the root context path using Session::setFlashCookieObject exposes the cookie to all web applications on the domain...
CVE-2021-3799
grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames...
CVE-2021-3818
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking...