PT-2026-52606 · Grav · Grav

Shrubberyrubbery · Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2020-37256

NVD

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2020-37256

Produtos afetados

Grav

Referências · 3

• https://github.com/getgrav/grav/security/advisories/GHSA-cvmr-6428-87w9 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-37256 · Nota de Segurança
• https://vulncheck.com/advisories/grav-cross-site-scripting-in-admin-plugin-page-editor · Nota