Packagist (Composer) package
getgrav/grav
pkg:composer/getgrav/grav
Vulnerabilities (64)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-29556 | — | >= 1.7.0-beta.1, <= 1.7.0-rc.17 | — | Mar 15, 2021 | The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSR | ||
| CVE-2020-11529 | — | < 1.6.23 | 1.6.23 | Apr 4, 2020 | Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x. | ||
| CVE-2019-16126 | — | < 1.7.0-beta.8 | 1.7.0-beta.8 | Sep 9, 2019 | Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images. | ||
| CVE-2018-5233 | — | < 1.3.0 | 1.3.0 | Mar 19, 2018 | Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools. |
- CVE-2020-29556Mar 15, 2021affected >= 1.7.0-beta.1, <= 1.7.0-rc.17
The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSR
- CVE-2020-11529Apr 4, 2020affected < 1.6.23fixed 1.6.23
Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.
- CVE-2019-16126Sep 9, 2019affected < 1.7.0-beta.8fixed 1.7.0-beta.8
Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
- CVE-2018-5233Mar 19, 2018affected < 1.3.0fixed 1.3.0
Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.
Page 4 of 4