Grav is a file-based Web platform

Grav before 1.0.18 Authentication Bypass via Scoped API Key

Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields

Grav before 1.0.8 Missing Authorization on API Key Generation

Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url

Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

Grav: Privilege Escalation via Missing Server-Side Validation of groups/access

grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation

Grav before 2.0.14 Privilege Escalation via Group Access Field

Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined…

Grav: Stored XSS via Tag Injection

Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav before 2.0.18 Remote Code Execution via sort filter

Grav before 4.2.2 Remote Code Execution via Email Twig

Grav API Plugin before 1.0.14 Missing Authorization

Grav before 2.0.15 Arbitrary File Write via error_log

Grav through 2.0.11 Authentication Bypass via Flex Objects

Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass

Grav before 1.0.13 API Key Scope Bypass via UsersController

Grav CMS before 2.0.13 Remote Code Execution via Twig

Grav before 1.0.13 Scope Bypass via createApiKey

Grav before 1.0.13 API Key Scope Bypass via PagesController

Grav before 1.0.13 Authentication Bypass via disable2fa

Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey

Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass

Grav Flex Objects - Server-Side Template Injection via Dynamic Titles

Grav: Low-privileged API users can create super-admin accounts via blueprint-upload

Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS

Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element

Grav is an open-source, flat-file content management system

Grav is an open-source, flat-file content management system

Grav is an open-source, flat-file content management system

Grav is an open-source, flat-file content management system

Grav is an open-source, flat-file content management system