Vulnerabilidades en Getgrav

102 resultados
Análisis Vexday

Getgrav possui 2 vulnerabilidades registradas, sendo 1 de criticidade alta (CVSS crítico), ambas relacionadas a Cross-Site Scripting (CWE-79). Nenhuma das falhas está sob exploração ativa documentada e todas antecedem os últimos 90 dias, indicando risco legado sem pressão imediata de ataque.

CVE-2026-62234HIGHGrav < 2.0.4 SSRF via Unrestricted cURL ProtocolsEPSS 0.3%CVE-2026-42610MEDIUMGrav: Sensitive Information Disclosure via Accounts Service BypassEPSS 0.3%CVE-2025-66306MEDIUMGrav vulnerable to Information Disclosure via IDOR in Grav Admin PanelEPSS 0.3%CVE-2026-58493MEDIUMgrav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String ConstructionEPSS 0.3%CVE-2026-62230HIGHGrav < 2.0.4 File Access Bypass via Case VariationEPSS 0.3%CVE-2026-62232CRITICALGrav < 2.0.4 2FA Bypass via Secret RegenerationEPSS 0.3%CVE-2026-44738HIGHGrav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()EPSS 0.3%CVE-2026-58656HIGHGrav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query ParameterEPSS 0.3%CVE-2026-62386HIGHGrav < 1.0.0-rc.16 Authentication Bypass via token URL ParameterEPSS 0.3%CVE-2026-65896HIGHGrav API Plugin before 1.0.10 Path Traversal via moveEPSS 0.3%CVE-2026-65007HIGHGrav before 1.0.8 Missing Authorization on API Key GenerationEPSS 0.3%CVE-2026-62387HIGHGrav < 1.0.0-rc.16 CORS Misconfiguration via API PluginEPSS 0.3%CVE-2026-44737MEDIUMgrav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]EPSS 0.3%CVE-2026-61873HIGHGrav before 9.1.8 Arbitrary File Write via Twig-Processed FilenameEPSS 0.3%CVE-2026-62237MEDIUMGrav < 2.0.4 ReDoS via regex_replace in SandboxEPSS 0.2%CVE-2026-61455HIGHGrav before 2.0.1 Decompression Bomb via ZipArchiverEPSS 0.2%CVE-2026-61449HIGHGrav before 2.0.2 Decompression Bomb via Forged ZIP SizeEPSS 0.2%CVE-2026-61450HIGHGrav before 2.0.2 Config Exfiltration via offsetGet FilterEPSS 0.2%CVE-2026-62233HIGHgrav-plugin-api < 1.0.6 Privilege Escalation via createApiKeyEPSS 0.2%CVE-2026-61451CRITICALGrav before 1.0.4 Password Reset Token Poisoning via admin_base_urlEPSS 0.2%