Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Getgrav — Vulnerabilities & Security Advisories 47

Browse all 47 CVE security advisories affecting Getgrav. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by Getgrav:gravgetgrav/gravgrav-plugin-admingetgrav/grav-plugin-adminGravCMSGrav CMS Admin Plugin
CVE IDTitleCVSSSeverityPublished
CVE-2020-36955 Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting — Grav CMS Admin PluginCWE-79 6.4 Medium2026-01-26
CVE-2021-47812 GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) — GravCMSCWE-862 9.8 Critical2026-01-15
CVE-2025-66312 Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]` — gravCWE-79 5.4AIMediumAI2025-12-01
CVE-2025-66311 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters — gravCWE-79 5.4AIMediumAI2025-12-01
CVE-2025-66310 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab — gravCWE-79 5.4AIMediumAI2025-12-01
CVE-2025-66309 Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab — gravCWE-79 6.1AIMediumAI2025-12-01
CVE-2025-66308 Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]` — gravCWE-79 5.4AIMediumAI2025-12-01
CVE-2025-66307 Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure — gravCWE-204 6.5 Medium2025-12-01
CVE-2025-66306 Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel — gravCWE-639 4.3 Medium2025-12-01
CVE-2025-66305 Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter — gravCWE-248 4.9AIMediumAI2025-12-01
CVE-2025-66304 Grav Exposes Password Hashes Leading to privilege escalation — gravCWE-200 6.2 Medium2025-12-01
CVE-2025-66303 Grav is vulnerable to a DOS on the admin panel — gravCWE-400 4.9 Medium2025-12-01
CVE-2025-66302 Grav vulnerable to Path Traversal allowing server files backup — gravCWE-22 6.8 Medium2025-12-01
CVE-2025-66301 Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions — gravCWE-285 4.3AIMediumAI2025-12-01
CVE-2025-66300 Grav is vulnerable to Arbitrary File Read — gravCWE-22 8.5 High2025-12-01
CVE-2025-66299 Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS — gravCWE-94 8.8 High2025-12-01
CVE-2025-66298 Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms — gravCWE-1336 5.3AIMediumAI2025-12-01
CVE-2025-66297 Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection — gravCWE-1336 7.2AIHighAI2025-12-01
CVE-2025-66296 Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover — gravCWE-266 8.8 High2025-12-01
CVE-2025-66294 Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass — gravCWE-94 7.2AIHighAI2025-12-01
CVE-2025-66295 Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption — gravCWE-22 8.8 High2025-12-01
CVE-2024-34082 Grav Arbitrary File Read to Account Takeover — gravCWE-269 8.5 High2024-05-15
CVE-2024-28119 Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler — gravCWE-94 8.8 High2024-03-21
CVE-2024-28118 Grav vulnerable to Server Side Template Injection (SSTI) — gravCWE-94 8.8 High2024-03-21
CVE-2024-28117 Grav vulnerable to Server Side Template Injection (SSTI) — gravCWE-94 8.8 High2024-03-21
CVE-2024-28116 Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass — gravCWE-94 8.8 High2024-03-21
CVE-2024-27921 Grav File Upload Path Traversal vulnerability — gravCWE-22 8.8 High2024-03-21
CVE-2024-27923 Remote Code Execution by uploading a phar file using frontmatter — gravCWE-287 8.8 High2024-03-06
CVE-2023-37897 Server-side Template Injection (SSTI) in grav — gravCWE-74 7.2 High2023-07-18
CVE-2023-34452 Grav vulnerable to Self Cross Site Scripting in /forgot_password — gravCWE-79 5.4 Medium2023-06-14

This page lists every published CVE security advisory associated with Getgrav. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.