cve.bz

getgrav grav vulnerabilities in 2024, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 9.9CVE-2024-34082EPSS 3.0%

    Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - `/grav/user/accounts/*.yaml`. This file …

  2. 8.8CVE-2024-28119EPSS 1.6%

    Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Tw…

  3. 8.8CVE-2024-28118EPSS 1.2%

    Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a pr…

  4. 8.8CVE-2024-28117EPSS 1.4%

    Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_m…

  5. 8.8CVE-2024-28116EPSS 5.8%

    Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbi…

  6. 8.8CVE-2024-27921EPSS 61%

    Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .jso…

  7. 8.8CVE-2024-27923EPSS 1.4%

    Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code ex…

  8. 5.4CVE-2023-31506EPSS 1.0%

    A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.