Grav CMS Cross-site scripting (XSS) vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-5233 · ADVISORY
• getgrav/grav · PACKAGE
• sysdream.com/news/lab/2018-03-15-cve-2018-5233-grav-cms-admin-plugin-reflected-cross-site-scripting-xss-vulnerability · WEB
• openwall.com/lists/oss-security/2018/03/15/1 · WEB
• sysdream.com/news/lab/2018-03-15-cve-2018-5233-grav-cms-admin-plugin-reflected-cross-site-scripting-xss-vulnerability · Exploit

getgrav/grav のその他の脆弱性

• CVE-2026-86197中 5.1Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav…
• CVE-2026-76846高 7.5Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configurat…
• CVE-2026-76839中 6.5Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() metho…
• CVE-2026-72702中 5.4Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Re…
• CVE-2026-72701低 3.7Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === op…