Skip to content
OpenAdvisories

Vendor

getgrav

212 known vulnerabilities.

Products

grav 158 grav-plugin-api 18 getgrav/grav 8 grav-plugin-login 7 grav-plugin-form 5 grav-plugin-admin 3 grav-plugin-shortcode-core 2 getgrav/grav-plugin-admin 2 grav-plugin-flex-objects 2 grav-plugin-guestbook 2 grav-plugin-comments 1 grav-plugin-data-manager 1 grav-plugin-star-ratings 1 grav-plugin-login-oauth 1 Grav CMS Admin Plugin 1 grav-plugin-datamanager 1 grav-plugin-admin2 1 GravCMS 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 1.8
    CVE-2025-64059

    Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is…

    getgrav grav
  • Low 3.7
    CVE-2026-72701

    Grav CMS before 2.0.16 Timing Attack via verifyNonce

    Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover…

    getgrav grav getgrav/grav Packagist