| Package | Affected versions | Patched versions |
|---|---|---|
| grav | = 1.10.7 |
GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free