Grav: Stored XSS via Tag Injection

Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav before 2.0.18 Remote Code Execution via sort filter

Grav before 4.2.2 Remote Code Execution via Email Twig

Grav API Plugin before 1.0.14 Missing Authorization

Grav before 2.0.15 Arbitrary File Write via error_log

Grav through 2.0.11 Authentication Bypass via Flex Objects

Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass

Grav before 1.0.13 API Key Scope Bypass via UsersController

Grav CMS before 2.0.13 Remote Code Execution via Twig

Grav before 1.0.13 Scope Bypass via createApiKey

Grav before 1.0.13 API Key Scope Bypass via PagesController

Grav before 1.0.13 Authentication Bypass via disable2fa

Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey

Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass

Grav Flex Objects - Server-Side Template Injection via Dynamic Titles

Grav: Low-privileged API users can create super-admin accounts via blueprint-upload

Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS

Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element

Grav is an open-source, flat-file content management system

Grav is an open-source, flat-file content management system

Grav is an open-source, flat-file content management system

Grav is an open-source, flat-file content management system

Grav is an open-source, flat-file content management system

Grav is a content management system (CMS)

Grav is a file-based Web-platform built in PHP

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass

Grav Admin Plugin — IDOR Privilege Escalation via saveUser()

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Grav API Plugin before 1.0.10 Broken Access Control

Grav is vulnerable to Arbitrary File Read

Grav CMS before 2.0.16 Symlink Following via createLockFile

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint

Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint

Grav < 2.0.4 SSRF via Unrestricted cURL Protocols

Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator

Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename