CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76839

Grav before 2.0.16 is affected by an information disclosure vulnerability in its sandboxed Twig templates. The allow-listed offsetGet() and offsetexists() methods lack field filtering on User objects , permitting attackers with page-edit permissions to extract hashed passwords and 2FA secrets , e...

CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders. An attacker with page-content edit access (low privilege) can bypass the config_denied_paths restrictions by using dot notation in Twig templates, exposing raw configuration values inclu...

EUVD-2026-65212

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

CVE-2026-72699 Grav Login Plugin before 3.9.1 Email Enumeration via Registration

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

EUVD-2026-65213

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72698 Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...

CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

EUVD-2026-65205

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

CVE-2026-56707

Grav Flex Objects plugin (versions 1.4.0 through 1.4.7 ) contains an authorization bypass in the flex-objects shortcode. Any user with page-edit access can embed the shortcode in a published page to render any registered Flex collection without the permission checks enforced in the admin panel's ...

CVE-2026-10630 WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

CVE-2026-10630

WP Courses LMS (WordPress plugin) is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 3.2.29 . The resultID parameter in the wpcq_get_quiz_result AJAX action lacks proper ownership validation, allowing authenticated users with custom-level access or above ...

WordPress WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Custom+ Sensitive Information Disclosure vulnerability discovered by Vapour in WordPress Plugin WP Courses LMS versions = 3.2.29...

EUVD-2026-65192

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

CVE-2018-7690

CVE-2018-7690 L'API REST di SSC contiene vulnerabilità di Insecure Direct Object Reference IDOR che consentono agli utenti autenticati di accedere a dettagli arbitrari degli utenti Local e LDAP tramite il metodo POST e a dettagli arbitrari dei progetti Fortify di altri utenti tramite il metodo GE...

CVE-2007-6638

CVE-2007-6638 March Networks DVR 3204 - كشف معلومات ملف السجل منشور Exploit-DB على https://www.exploit-db.com/exploits/4797/ المؤلف Alex Hernandez المعروف بـ @alt3kx...

CVE-2001-0934

CVE-2001-0934 Cooolsoft PowerFTP Server 2.03 permet à des attaquants distants d'obtenir le chemin physique de la racine du serveur via la commande pwd, qui liste le chemin complet. Publication Securiteam sur http://www.securiteam.com/exploits/6D00L2A35K.html Informations externes sur...

CVE-2001-0933

CVE-2001-0933 Cooolsoft PowerFTP Server 2.03 consente agli attaccanti remoti di elencare il contenuto di unità arbitrarie tramite un comando ls LIST che include la lettera dell'unità come argomento, ad es. "ls C:". Pubblicazione di Securiteam all'indirizzo...