Vulnerabilidades en Getgrav

187 resultados
Análisis Vexday

Getgrav possui 2 vulnerabilidades registradas, sendo 1 de criticidade alta (CVSS crítico), ambas relacionadas a Cross-Site Scripting (CWE-79). Nenhuma das falhas está sob exploração ativa documentada e todas antecedem os últimos 90 dias, indicando risco legado sem pressão imediata de ataque.

CVE-2026-76839HIGHGrav before 2.0.16 Information Disclosure via offsetGetEPSS 0.5%CVE-2026-64850HIGHGrav: Remote code execution via unrestricted callable in Blueprint::dynamicData()EPSS 0.5%CVE-2026-64851HIGHGrav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlersEPSS 0.5%CVE-2026-72697HIGHGrav CMS before 2.0.16 Path Traversal via media_directoryEPSS 0.5%CVE-2026-61873HIGHGrav before 9.1.8 Arbitrary File Write via Twig-Processed FilenameEPSS 0.5%CVE-2026-92917HIGHGrav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_rEPSS 0.5%CVE-2026-62232CRITICALGrav < 2.0.4 2FA Bypass via Secret RegenerationEPSS 0.5%CVE-2025-66300HIGHGrav is vulnerable to Arbitrary File ReadEPSS 0.5%CVE-2026-58656HIGHGrav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query ParameterEPSS 0.5%CVE-2026-62668CRITICALGrav API Plugin: Webhook SSRF via Unrestricted cURL ProtocolsEPSS 0.4%CVE-2026-100672HIGHgrav-plugin-comments before 1.2.11 Unauthenticated Information DisclosureEPSS 0.4%CVE-2026-42845HIGHGrav: Anonymous Page Content Overwrite via Form File Upload filename OverrideEPSS 0.4%CVE-2026-100669HIGHGrav before 2.0.25 Sensitive File Disclosure via Case-Variation BypassEPSS 0.4%CVE-2026-62233HIGHgrav-plugin-api < 1.0.6 Privilege Escalation via createApiKeyEPSS 0.4%CVE-2026-65603HIGHGrav Login Plugin 3.8.11 Privilege Escalation via Profile UpdateEPSS 0.4%CVE-2026-61449HIGHGrav before 2.0.2 Decompression Bomb via Forged ZIP SizeEPSS 0.4%CVE-2026-61842MEDIUMGrav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)EPSS 0.4%CVE-2026-62237MEDIUMGrav < 2.0.4 ReDoS via regex_replace in SandboxEPSS 0.4%CVE-2026-61455HIGHGrav before 2.0.1 Decompression Bomb via ZipArchiverEPSS 0.4%CVE-2026-86196HIGHGrav API Plugin before 1.0.20 Authentication Bypass via Host HeaderEPSS 0.4%