Advisories · Technology

getgrav/grav-plugin-admin.

Every CVE that names getgrav/grav-plugin-admin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2021-3920 CVE record

CVSS 4.6 Medium

Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin
- getgrav/grav-plugin-admin
- Cross-site scripting (XSS)
Not analysed yet 19 Nov 2021
CVE-2021-3799 CVE record

CVSS 5.4 Medium

Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin
- getgrav/grav-plugin-admin
- CWE-1021
Not analysed yet 27 Sept 2021
CVE-2021-29439 CVE record

CVSS 7.2 High

Plugins can be installed with minimal admin privileges
- getgrav grav-plugin-admin
- Broken access control
Not analysed yet 13 Apr 2021
CVE-2021-21425 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Unauthenticated Arbitrary YAML Write/Update leads to Code Execution
- getgrav grav-plugin-admin
- Broken access control
Not analysed yet 7 Apr 2021