Description (CNA)
Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the page title field. Attackers can create a new page with a malicious script in the title, which will be executed when the page is viewed in the admin panel or on the site.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Getgrav / Grav CMS Admin Plugin | affected 0 through 1.9.18 |
CWE
CWE-79
References
- https://www.exploit-db.com/exploits/49264
- https://getgrav.org/
- https://www.vulncheck.com/advisories/grav-cms-admin-plugin-page-title-persistent-cross-site-scripting
ADP enrichment
No English description supplied.
No references supplied.