All 5 CVE vulnerabilities found in grav-plugin-login, with AI-generated Chinese analysis, references, and POCs.
Vendor: getgrav
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-109314 | Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page CWE-200 | 7.3 | High | 2026-10-12 |
| CVE-2026-109313 | Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie CWE-287 | 8.1 | High | 2026-10-12 |
| CVE-2026-109312 | Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form CWE-287 | 8.1 | High | 2026-10-12 |
| CVE-2026-72699 | Grav Login Plugin before 3.9.1 Email Enumeration via Registration CWE-203 | 5.3 | Medium | 2026-08-25 |
| CVE-2026-62671 | CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret) CWE-352 | 5.4 | Medium | 2026-08-19 |
All 5 known CVE vulnerabilities affecting grav-plugin-login with full Chinese analysis, references, and POCs where available.