Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface

Grav before 2.0.25 Session Cookie Theft via Twig Sandbox

Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

Grav before 2.0.15 Stored XSS via audio/video source URL

Grav before 1.0.13 API-key scope cap bypass via ReportsController

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin

Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

Grav before 2.1.7 Information Disclosure via Nested .git Directories

Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass

Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork

Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison

Grav before 3.9.2 Host Header Injection via sendInvitationEmail

Grav CMS before 2.0.11 Path Traversal via watermark

Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter

Grav < 2.0.4 File Access Bypass via Case Variation

Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter

Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Grav < 2.0.4 2FA Bypass via Secret Regeneration

Grav before 1.0.13 API Key Scope Bypass via InvitationsController

Grav Exposes Password Hashes Leading to privilege escalation

Grav is a flat-file content management system

Grav is a flat-file content management system

Grav is a flat-file content management system

Grav is a flat-file content management system

Code Injection in GitHub repository getgrav/grav prior to 1.7.34

Grav is a file based Web-platform

grav-plugin-api before 1.0.15 Path Traversal via batchCopy

Grav API Plugin before 1.0.10 Path Traversal via move

Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin