CVE search

402.386 vulnerabilities · 1.766 actively exploited (CISA KEV)

5 results

ID	Severity	Summary	Published
CVE-2020-29553	HOCH8.8	The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).	15/03/2021
CVE-2020-29556	MITTEL5.5	The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)	15/03/2021
CVE-2020-29555	HOCH8.1	The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)