grav-plugin-api before 1.0.15 Path Traversal via batchCopy

Grav API Plugin before 1.0.10 Path Traversal via move

Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin

Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets

Grav vulnerable to Path Traversal allowing server files backup

Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms

Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

Grav before 2.0.25 Sandbox Escape via array Filter

Grav Admin Plugin Path Traversal via Save As Language Code

Grav before 2.0.16 Information Disclosure via offsetGet

Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Grav CMS before 2.0.16 Path Traversal via media_directory

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

Grav < 2.0.4 ReDoS via regex_replace in Sandbox

Grav before 2.0.2 Decompression Bomb via Forged ZIP Size

Grav before 2.0.1 Decompression Bomb via ZipArchiver

Grav before 2.0.2 Config Exfiltration via offsetGet Filter

Grav: Sensitive Information Disclosure via Accounts Service Bypass

Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages

Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives

Grav Flex-Objects < 1.4.3 Authorization Bypass via API

Grav before 2.0.1 XSS via Twig String Concatenation

Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS)

Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS)

A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload

Grav is a flat-file content management system

Common/Grav.php in Grav before 1.7 has an Open Redirect

Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri

Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav before 1.0.18 Authentication Bypass via Scoped API Key

Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte

Grav Form Plugin before 9.1.19 Stored XSS via Field Properties

Grav before 2.0.12 Stored XSS via quoted-attribute bypass

Grav before 1.0.13 API-key scope cap bypass via DemoController

Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle

Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret

Grav - Cross-Site Scripting in Admin Plugin Page Editor

grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel

Grav: Publisher-Level Stored XSS via Unquoted Event Attributes

grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality

Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`

Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters