Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure via the printr filter in Twig templates when content sandboxing fails to restrict certain filters. An attacker can access...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

EUVD-2026-81439

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917

In Grav (a flat-file CMS) versions 2.0.0-rc.1 through 2.0.21 , the Twig content sandbox fails to restrict dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string). The guard GravExtension::assertSandboxDumpSafe() calls SandboxExtension::isSandboxed() without a Source argume...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-19985

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'posttypes', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssidebugarray...

CVE-2026-61450: Improper Control of Generation of Code

Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author any admin.pages user, or anyone able to write to user/pages to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method...

CVE-2021-4363: Improper Neutralization of Input During Web Page Generation

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and output escaping on the 'savecontentfront' function that uses printr on the user-supplied $REQUEST values . This makes ...

HTML Purifier Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in smoketests/configForm.php in HTML Purifier before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "unescaped printr output."...

CVE-2007-3498

Cross-site scripting XSS vulnerability in smoketests/configForm.php in HTML Purifier before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "unescaped printr output."...

Cross site scripting

Cross-site scripting XSS vulnerability in smoketests/configForm.php in HTML Purifier before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "unescaped printr output."...

CVE-2007-3498

Cross-site scripting XSS vulnerability in smoketests/configForm.php in HTML Purifier before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "unescaped printr output."...

CVE-2007-3498: Undefined Security Weakness

Cross-site scripting XSS vulnerability in smoketests/configForm.php in HTML Purifier before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "unescaped printr output."...