grav.

Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

• grav
• Information disclosure

Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

• grav
• CWE-749

Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives

• grav
• Code injection

Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri

• grav
• Information disclosure

Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

• grav
• Denial of service

Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

• grav
• Information disclosure

Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

• grav
• CWE-749

Grav before 2.1.7 Information Disclosure via Nested .git Directories

• grav
• CWE-527

Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

• grav
• Information disclosure

Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms

• grav
• CWE-409

Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

• grav
• Information disclosure

Grav before 2.0.25 Session Cookie Theft via Twig Sandbox

• grav
• Information disclosure

Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

• grav
• Broken access control

Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass

• grav
• CWE-178

Grav before 2.0.25 Sandbox Escape via array Filter

• grav
• Information disclosure

grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass

• grav
• Authentication bypass

Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

• grav
• Information disclosure

Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork

• grav
• Information disclosure

Cross-site scripting in Grav

• Grav
• Cross-site scripting (XSS)

Grav before 2.0.18 Remote Code Execution via sort filter

• grav
• Code injection

Grav Admin Plugin Path Traversal via Save As Language Code

• grav
• Path traversal

Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

• grav
• Cross-site scripting (XSS)

Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages

• grav
• Cross-site scripting (XSS)

Grav before 1.0.18 Authentication Bypass via Scoped API Key

• grav
• Broken access control

Grav before 1.0.18 Authentication Bypass via Scoped API Key

• grav
• Broken access control

Grav before 4.2.2 Remote Code Execution via Email Twig

• grav
• Code injection

Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison

• grav
• CWE-208

Grav CMS before 2.0.16 Symlink Following via createLockFile

• grav
• Path traversal

Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

• grav
• Broken access control

Grav before 3.9.2 Host Header Injection via sendInvitationEmail

• grav
• CWE-350

Grav API Plugin before 1.0.16 SSRF via DNS Rebinding

• grav
• Race condition

Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

• grav
• Broken access control

Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

• grav
• getgrav grav-plugin-api
• Server-side request forgery (SSRF)

Grav: Unauthenticated open redirect via login twofa_cancel _redirect

• grav
• Open redirect

Grav API Plugin before 1.0.14 Missing Authorization

• grav
• Broken access control

Grav API Plugin before 1.0.14 Missing Authorization

• grav
• Broken access control

Grav API Plugin Open Redirect via Backslash Bypass

• grav
• Open redirect

Grav API Plugin before 1.0.14 Authorization Bypass

• grav
• Broken access control

grav-plugin-api before 1.0.15 Path Traversal via batchCopy

• grav
• Path traversal

grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint

• grav
• Code injection

Grav Form Plugin before 9.1.19 Stored XSS via Field Properties

• grav
• Cross-site scripting (XSS)

Grav plugin-api before 1.0.15 Script Injection via SVG

• grav
• Cross-site scripting (XSS)

Grav through 2.0.11 Authentication Bypass via Flex Objects

• grav
• trilbymedia grav-plugin-flex-objects
• Broken access control

Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass

• grav
• Privilege escalation

Grav before 1.0.13 API Key Scope Bypass via UsersController

• grav
• Privilege escalation

Grav before 1.0.13 API Key Scope Bypass via InvitationsController

• grav
• Privilege escalation

Grav CMS before 2.0.13 Remote Code Execution via Twig

• grav
• Code injection

Grav before 1.0.13 API Key Scope Bypass via PagesController

• grav
• Broken access control

Grav before 1.0.13 API-key scope cap bypass via DemoController

• grav
• Broken access control

Grav before 1.0.13 Authentication Bypass via disable2fa

• grav
• Authentication bypass

Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle

• grav
• Cross-site scripting (XSS)

Grav 2.0.11 Path Traversal via Backup Profile Configuration

• grav
• Path traversal

Grav Login Plugin before 3.8.13 Insufficient Session Expiration

• grav
• Authentication bypass

Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

• grav
• Privilege escalation

Grav API Plugin before 1.0.10 Path Traversal via move

• grav
• Path traversal

Grav API Plugin before 1.0.10 Broken Access Control

• grav
• Broken access control

Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

• grav
• Privilege escalation

Grav before 1.0.8 Missing Authorization on API Key Generation

• grav
• Broken access control

Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

• grav
• Cross-site scripting (XSS)

Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin

• grav
• CWE-942