Filtered by vendor Getgrav
Subscribe
Total
36 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-2073 | 1 Getgrav | 1 Grav | 2022-07-08 | 6.5 MEDIUM | 7.2 HIGH |
| Code Injection in GitHub repository getgrav/grav prior to 1.7.34. | |||||
| CVE-2022-1173 | 1 Getgrav | 1 Grav | 2022-05-05 | 3.5 LOW | 5.4 MEDIUM |
| stored xss in GitHub repository getgrav/grav prior to 1.7.33. | |||||
| CVE-2022-0970 | 1 Getgrav | 1 Grav | 2022-03-22 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. | |||||
| CVE-2022-0743 | 1 Getgrav | 1 Grav | 2022-03-10 | 3.5 LOW | 4.6 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. | |||||
| CVE-2022-0268 | 1 Getgrav | 1 Grav | 2022-01-28 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28. | |||||
| CVE-2021-3920 | 1 Getgrav | 1 Grav-plugin-admin | 2021-11-23 | 3.5 LOW | 5.4 MEDIUM |
| grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2021-3924 | 1 Getgrav | 1 Grav | 2021-11-09 | 5.0 MEDIUM | 7.5 HIGH |
| grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | |||||
| CVE-2021-3904 | 1 Getgrav | 1 Grav | 2021-10-29 | 3.5 LOW | 5.4 MEDIUM |
| grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2021-3799 | 1 Getgrav | 1 Grav-plugin-admin | 2021-09-30 | 5.8 MEDIUM | 5.4 MEDIUM |
| grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames | |||||
| CVE-2021-3818 | 1 Getgrav | 1 Grav | 2021-09-30 | 5.0 MEDIUM | 5.3 MEDIUM |
| grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking | |||||
| CVE-2020-11529 | 1 Getgrav | 1 Grav | 2021-05-17 | 5.8 MEDIUM | 6.1 MEDIUM |
| Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x. | |||||
| CVE-2020-29556 | 1 Getgrav | 1 Grav Cms | 2021-03-25 | 2.1 LOW | 5.5 MEDIUM |
| The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.) | |||||
| CVE-2020-29555 | 1 Getgrav | 1 Grav Cms | 2021-03-25 | 5.5 MEDIUM | 8.1 HIGH |
| The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.) | |||||
| CVE-2020-29553 | 1 Getgrav | 1 Grav Cms | 2021-03-18 | 5.1 MEDIUM | 8.8 HIGH |
| The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF). | |||||
| CVE-2019-16126 | 1 Getgrav | 1 Grav Cms | 2019-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images. | |||||
| CVE-2018-5233 | 1 Getgrav | 1 Grav Cms | 2018-04-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools. | |||||