Vulnerabilities in getgrav
211 resultsCVE-2021-3799MEDIUMImproper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-adminEPSS 1.6%CVE-2024-28119HIGHGrav vulnerable to Server Side Template Injection (SSTI) via Twig escape handlerEPSS 1.6%CVE-2022-1173HIGHstored xss in getgrav/gravEPSS 1.5%CVE-2025-66301HIGHGrav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actionsEPSS 1.4%CVE-2026-58655HIGHGrav Flex Objects - Server-Side Template Injection via Dynamic TitlesEPSS 1.4%CVE-2022-0268MEDIUMCross-site Scripting (XSS) - Stored in getgrav/gravEPSS 1.4%CVE-2024-28117HIGHGrav vulnerable to Server Side Template Injection (SSTI)EPSS 1.4%CVE-2021-3920MEDIUMCross-site Scripting (XSS) - Stored in getgrav/grav-plugin-adminEPSS 1.4%CVE-2022-0743MEDIUMCross-site Scripting (XSS) - Stored in getgrav/gravEPSS 1.4%CVE-2024-27923HIGHRemote Code Execution by uploading a phar file using frontmatterEPSS 1.4%CVE-2024-28118HIGHGrav vulnerable to Server Side Template Injection (SSTI)EPSS 1.2%CVE-2026-42613CRITICALGrav: Privilege Escalation via Missing Server-Side Validation of groups/accessEPSS 1.1%CVE-2026-65608HIGHGrav before 2.0.9 Remote Code Execution via FlexDirectoryEPSS 1.1%CVE-2026-72819HIGHGrav CMS before 2.0.13 Remote Code Execution via ZIP UploadEPSS 0.9%CVE-2026-85604HIGHGrav before 2.0.18 Remote Code Execution via sort filterEPSS 0.9%CVE-2026-75827CRITICALGrav before 2.0.15 Arbitrary File Write via error_logEPSS 0.9%CVE-2026-72831HIGHGrav through 2.0.11 Authentication Bypass via Flex ObjectsEPSS 0.9%CVE-2026-72827HIGHGrav CMS before 2.0.13 Remote Code Execution via TwigEPSS 0.9%CVE-2025-66297HIGHGrav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig InjectionEPSS 0.8%CVE-2026-112779CRITICALGrav API Plugin before 1.0.42 Cache Exhaustion and Page Permission BypassEPSS 0.8%