CVE-2026-58657 Grav - Stored CSS Injection via Markdown Image resize() Action

Grav before 2.0.0 affected through 2.0.0-rc.9 and the 2.0 branch contains a stored CSS injection vulnerability in the Markdown image resize media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the resize action in Excerpts::processMediaActions...

CVE-2026-42841: Improper Neutralization of Input During Web Page Generation

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters...

CVE-2022-28528

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit...

PT-2022-19067

Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue is related to an arbitrary file upload vulnerability. This vulnerability can be exploited via the "/admin/index.php?mode=content&page=media&action=edit" API endpoint. Recommendations For...

PT-2021-10381

Name of the Vulnerable Software and Affected Versions: INSMA Wifi Mini Spy 1080P HD Security IP Camera version 1.9.7 B Description: An issue allows an unauthenticated attacker to cause a Denial of Service by rebooting the device. This can be achieved by sending a hidden reboot command to the...