Exposure of Grav

CMS
199
exposure score
718
sites use
0
exploited
18
critical

CVEs

162 results
CVE-2025-66307MEDIUMGrav Admin Plugin vulnerable to User Enumeration & Email DisclosureEPSS 0.3%CVE-2026-42844HIGHGrav: Low-privileged API users can create super-admin accounts via blueprint-uploadEPSS 0.3%CVE-2026-62386HIGHGrav < 1.0.0-rc.16 Authentication Bypass via token URL ParameterEPSS 0.3%CVE-2026-65007HIGHGrav before 1.0.8 Missing Authorization on API Key GenerationEPSS 0.3%CVE-2026-72823MEDIUMGrav before 1.0.13 API-key scope cap bypass via DemoControllerEPSS 0.3%CVE-2026-65896HIGHGrav API Plugin before 1.0.10 Path Traversal via moveEPSS 0.3%CVE-2026-109324HIGHGrav before 2.1.7 Memory Exhaustion via Oversized Image TransformsEPSS 0.3%CVE-2025-66306MEDIUMGrav vulnerable to Information Disclosure via IDOR in Grav Admin PanelEPSS 0.3%CVE-2026-72832MEDIUMGrav before 2.0.13 Stored XSS via quoted-attribute bypassEPSS 0.3%CVE-2026-62387HIGHGrav < 1.0.0-rc.16 CORS Misconfiguration via API PluginEPSS 0.3%CVE-2026-61454HIGHGrav before 2.0.4 Information Disclosure via __GRAV_CONFIG__EPSS 0.3%CVE-2026-61873HIGHGrav before 9.1.8 Arbitrary File Write via Twig-Processed FilenameEPSS 0.3%CVE-2026-75835CRITICALGrav API Plugin before 1.0.14 Missing AuthorizationEPSS 0.3%CVE-2026-117604HIGHGrav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback FallbackEPSS 0.3%CVE-2026-100667MEDIUMgrav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication BypassEPSS 0.3%CVE-2026-76846HIGHGrav before 2.0.16 Information Disclosure via Twig SandboxEPSS 0.3%CVE-2026-56701HIGHGrav - XML External Entity Injection via SVG UploadEPSS 0.3%CVE-2026-61455HIGHGrav before 2.0.1 Decompression Bomb via ZipArchiverEPSS 0.3%CVE-2026-62237MEDIUMGrav < 2.0.4 ReDoS via regex_replace in SandboxEPSS 0.3%CVE-2026-42611HIGHGrav: Stored XSS via Tag InjectionEPSS 0.3%