Vulnerabilidades en Getgrav
102 resultadosAnálisis Vexday
Getgrav possui 2 vulnerabilidades registradas, sendo 1 de criticidade alta (CVSS crítico), ambas relacionadas a Cross-Site Scripting (CWE-79). Nenhuma das falhas está sob exploração ativa documentada e todas antecedem os últimos 90 dias, indicando risco legado sem pressão imediata de ataque.
CVE-2026-61454HIGHGrav before 2.0.4 Information Disclosure via __GRAV_CONFIG__EPSS 0.2%CVE-2026-42612HIGHGrav: Publisher-Level Stored XSS via Unquoted Event AttributesEPSS 0.2%CVE-2026-69088HIGHGrav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via BlueprintEPSS 0.2%CVE-2026-65895HIGHGrav API Plugin before 1.0.10 Broken Access ControlEPSS 0.2%CVE-2025-66309MEDIUMGrav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tabEPSS 0.2%CVE-2026-62231HIGHGrav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticatorEPSS 0.2%CVE-2026-59190HIGHGrav Admin Plugin — IDOR Privilege Escalation via saveUser()EPSS 0.2%CVE-2026-69087HIGHGrav Form Plugin before 9.1.13 Open Redirect via form.value() TwigEPSS 0.2%CVE-2025-66312MEDIUMGrav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`EPSS 0.2%CVE-2025-66311MEDIUMGrav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parametersEPSS 0.2%CVE-2025-66310MEDIUMGrav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced TabEPSS 0.2%CVE-2025-66308MEDIUMGrav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`EPSS 0.2%CVE-2026-61452MEDIUMGrav before 2.0.4 Improper Session Invalidation JWT Access TokensEPSS 0.2%CVE-2026-55890MEDIUMGrav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()EPSS 0.2%CVE-2026-55885MEDIUMGrav: Admin Backup Zip File Exposes Account Credentials and Configuration SecretsEPSS 0.2%CVE-2026-62235LOWGrav Flex-Objects < 1.4.3 Authorization Bypass via APIEPSS 0.2%CVE-2026-61453MEDIUMGrav before 2.0.1 XSS via Twig String ConcatenationEPSS 0.2%CVE-2026-66400MEDIUMGrav Login Plugin before 3.8.13 Insufficient Session ExpirationEPSS 0.2%CVE-2026-64628MEDIUMGrav Stored Cross-Site Scripting via Shortcode Attribute HandlersEPSS 0.1%CVE-2026-42842MEDIUMgrav-plugin-form: XSS via Taxonomy Field Values in Admin PanelEPSS 0.1%