Known vulnerabilities in Grav CMS - page 3

Vendor: Grav CMS
Software: Grav CMS
Software CPE: cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*
Website: https://getgrav.org/
Total vulnerabilities: 62
Public exploits: 7
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Grav CMS Grav CMS is affected by 62 known vulnerabilities: 8 high, 19 medium, 35 low Critical High Medium Low

Vulnerabilities (62)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU130071 - Improper Access Control
CVE-2025-66300		 CWE-284 Medium
No
No
 1.8.0 beta.27 05.05.2026 SB2026050588
#VU130070 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2025-66299		 CWE-1336 Medium
No
No
 1.8.0 beta.27 05.05.2026 SB2026050588
#VU130050 - Improper Access Control
CVE-2024-34082		 CWE-284 Medium
No
No
 1.7.46 15.05.2024 SB2024051540
#VU87721 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-28119		 CWE-94 High
No
No
 1.7.45 22.03.2024 SB2024032222
#VU87717 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-28118		 CWE-94 High
No
No
 1.7.45 22.03.2024 SB2024032222
#VU87715 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-28117		 CWE-94 High
No
No
 1.7.45 22.03.2024 SB2024032222
#VU87712 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-28116		 CWE-94 Medium
Available
No
 1.7.45 22.03.2024 SB2024032222
#VU87711 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-27921		 CWE-22 High
No
No
 1.7.45 22.03.2024 SB2024032222
#VU130047 - Return of Wrong Status Code
CVE-2023-37897		 CWE-393 Low
No
No
 1.7.42.2 18.07.2023 SB2023071878
#VU77513 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-34253		 CWE-94 Low
No
No
 1.7.42 19.06.2023 SB2023061920
#VU77512 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-30594		 CWE-94 Low
No
No
 1.7.42 19.06.2023 SB2023061920
#VU77511 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-30593		 CWE-94 Low
No
No
 1.7.42 19.06.2023 SB2023061920
#VU77510 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-30592		 CWE-94 Low
No
No
 1.7.42 19.06.2023 SB2023061920
#VU77509 - Improper input validation
CVE-2023-34448		 CWE-20 Low
No
No
 1.7.42 19.06.2023 SB2023061920
#VU77508 - Incomplete List of Disallowed Inputs
CVE-2023-34252		 CWE-184 Low
No
No
 1.7.42 19.06.2023 SB2023061920
#VU77507 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-34251		 CWE-94 Low
No
No
 1.7.42 19.06.2023 SB2023061920
#VU57921 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3904		 CWE-79 Low
No
No
 1.7.24 03.11.2021 SB2021110306
#VU52363 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-29440		 CWE-94 Medium
Available
No
 1.7.11 20.04.2021 SB2021042006
#VU130046 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.6.30 10.12.2020 SB2020121038
#VU30315 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2020-11529		 CWE-601 Low
No
No
 1.6.23 04.04.2020 SB2020040411


Showing elements 41 - 60 out of 62