cve.bz

getgrav grav vulnerabilities in 2023, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 8.8CVE-2023-37897EPSS 2.8%

    Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1…

  2. 6.1CVE-2023-34452EPSS 0.6%

    Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the …

  3. 7.2CVE-2023-34448EPSS 4.5%

    Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions …

  4. 7.2CVE-2023-34253EPSS 2.1%

    Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily s…

  5. 7.2CVE-2023-34252EPSS 2.1%

    Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument pass…

  6. 7.2CVE-2023-34251EPSS 2.3%

    Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page edi…