Skip to content
OpenAdvisories

Vendor

getgrav

213 known vulnerabilities.

Products

grav 159 grav-plugin-api 18 getgrav/grav 8 grav-plugin-login 7 grav-plugin-form 5 grav-plugin-admin 3 grav-plugin-shortcode-core 2 getgrav/grav-plugin-admin 2 grav-plugin-flex-objects 2 grav-plugin-guestbook 2 grav-plugin-comments 1 grav-plugin-data-manager 1 grav-plugin-star-ratings 1 grav-plugin-login-oauth 1 Grav CMS Admin Plugin 1 grav-plugin-datamanager 1 grav-plugin-admin2 1 GravCMS 1
All Critical High Medium Low Exploited only Public exploit

213 results · Feed

  • Critical 9.1
    CVE-2022-2073 EPSS 11%

    Code Injection in getgrav/grav

    Code Injection in GitHub repository getgrav/grav prior to 1.7.34.

    getgrav getgrav/grav getgrav/grav Packagist
  • High 8.2
    CVE-2022-1173

    stored xss in getgrav/grav

    stored xss in GitHub repository getgrav/grav prior to 1.7.33.

    getgrav getgrav/grav getgrav/grav Packagist
  • High 7.1
    CVE-2022-0970

    Cross-site Scripting (XSS) - Stored in getgrav/grav

    Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.

    getgrav getgrav/grav getgrav/grav Packagist
  • Medium 4.6
    CVE-2022-0743

    Cross-site Scripting (XSS) - Stored in getgrav/grav

    Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.

    getgrav getgrav/grav getgrav/grav Packagist
  • Medium 5.7
    CVE-2022-0268

    Cross-site Scripting (XSS) - Stored in getgrav/grav

    Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.

    getgrav getgrav/grav getgrav/grav Packagist
  • Medium 4.6
    CVE-2021-3920

    Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin

    grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    getgrav getgrav/grav-plugin-admin
  • High 8.8
    CVE-2021-3924

    Path Traversal in getgrav/grav

    grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    getgrav getgrav/grav getgrav/grav Packagist
  • Medium 6.3
    CVE-2021-3904

    Cross-site Scripting (XSS) - Stored in getgrav/grav

    grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    getgrav getgrav/grav getgrav/grav Packagist
  • Medium 6.3
    CVE-2021-3818

    Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

    grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking

    getgrav getgrav/grav getgrav/grav Packagist
  • Medium 5.4
    CVE-2021-3799

    Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin

    grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames

    getgrav getgrav/grav-plugin-admin
  • High 8.4
    CVE-2021-29440 Public exploit EPSS 30%

    Twig allowing dangerous PHP functions by default

    Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code executio…

    getgrav grav getgrav/grav Packagist
  • High 7.2
    CVE-2021-29439

    Plugins can be installed with minimal admin privileges

    The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obt…

    getgrav grav-plugin-admin
  • Critical 9.3
    CVE-2021-21425 Public exploit EPSS 81%

    Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

    Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Partic…

    getgrav grav-plugin-admin