Grav is a file-based Web platform

Grav before 1.0.18 Authentication Bypass via Scoped API Key

Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields

Grav before 1.0.8 Missing Authorization on API Key Generation

Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url

Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

Grav: Privilege Escalation via Missing Server-Side Validation of groups/access

grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation

Grav before 2.0.14 Privilege Escalation via Group Access Field

Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined…