Medium severity5.4NVD Advisory· Published Jun 25, 2026· Updated Jun 27, 2026
CVE-2020-37256
CVE-2020-37256
Description
Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.
Affected products
2Patches
Vulnerability mechanics
References
2- github.com/getgrav/grav/security/advisories/GHSA-cvmr-6428-87w9nvdVendor Advisory
- www.vulncheck.com/advisories/grav-cross-site-scripting-in-admin-plugin-page-editornvdThird Party Advisory
News mentions
0No linked articles in our index yet.