Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
Vulnerability Description
GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
授权机制缺失
Vulnerability Title
GravCMS 安全漏洞
Vulnerability Description
GravCMS是Grav公司的一个内容管理系统。 GravCMS 1.10.7版本存在安全漏洞，该漏洞源于未经验证写入任意YAML配置，可能导致通过调度程序端点执行PHP代码。
CVSS Information
N/A
Vulnerability Type
N/A