Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arb...
9.8CVSS
9.4AI Score
0.85EPSS
The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission admin.login can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obtain an arbitrary code execution primitive ...
7.2CVSS
7.3AI Score
0.001EPSS
grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames
5.4CVSS
5.5AI Score
0.001EPSS
grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
5.4CVSS
5.4AI Score
0.001EPSS