Summary
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[taxonomies] parameter. The injected payload is stored on the server and automatically executed in the browser of any user who accesses the affected site configuration, resulting in a persistent attack vector.
---
Details
Vulnerable Endpoint: POST /admin/config/site Parameter: data[taxonomies]
The application does not properly validate or sanitize input in the data[taxonomies] field. As a result, an attacker can inject JavaScript code, which is stored in the site configuration and later rendered in the administrative interface or site output, causing automatic execution in the user's browser.
---
PoC
Payload:
"><script>alert('XSS-PoC')</script>
Steps to Reproduce:
1. Log in to the Grav Admin Panel with sufficient permissions to modify site configuration. 2. Navigate to Configuration > Site. 3. In the Taxonomies Types field (which maps to data[taxonomies]), insert the payload above: "><script>alert('XSS-PoC')</script> 4. Save the configuration.
<img width="1897" height="628" alt="Pasted image 20250718195942" src="https://github.com/user-attachments/assets/2035fcaa-34fc-494c-a7ca-7c1e1f34b057" /> 5. Go on Pages and click on one of them
<img width="932" height="587" alt="Pasted image 20250718200306" src="https://github.com/user-attachments/assets/3c1995ba-2581-4e27-ae9d-a17e2eeb5b57" /> 6. The stored payload is executed immediately in the browser, confirming the Stored XSS vulnerability.
<img width="1204" height="377" alt="Pasted image 20250718200353" src="https://github.com/user-attachments/assets/ad8ea7ea-603f-4b84-aa5a-120de0cb56ce" /> 7. The HTTP request submitted during this process contains the vulnerable parameter and payload: <img width="757" height="675" alt="Pasted image 20250718200445" src="https://github.com/user-attachments/assets/fbbe2b76-00eb-4426-8ddd-5cde2cc65d77" />
---
Impact
Stored XSS attacks can lead to severe consequences, including:
- Session hijacking: Stealing cookies or authentication tokens to impersonate users - Credential theft: Harvesting usernames and passwords using malicious scripts - Malware delivery: Distributing unwanted or harmful code to victims - Privilege escalation: Compromising administrative users through persistent scripts - Data manipulation or defacement: Changing or disrupting site content - Reputation damage: Eroding trust among site users and administrators
---
Discoverer
Marcelo Queiroz
by CVE-Hunters
Grav v1.7.49.5 / Admin v1.10.49.1 – User Enumeration & Email Disclosure
Summary A user enumeration and email disclosure vulnerability exists in Grav v1.7.49.5 with Admin plugin v1.10.49.1. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering.
Details
The issue resides in the taskForgot() function, which handles the forgot password workflow. Relevant vulnerable logic:
php if (null === $user || $user->state !== 'enabled' || !$to) { ... // Generic message for invalid/non-existing users $this->setMessage($this->translate('PLUGINADMIN.FORGOTINSTRUCTIONSSENTVIAEMAIL')); return $this->createRedirectResponse($current); }
if ($rateLimiter->isRateLimited($username)) { ... $interval = $config->get('plugins.login.maxpwresetsinterval', 2);
// Sensitive message for valid users $this->setMessage($this->translate('PLUGINLOGIN.FORGOTCANNOTRESETITISBLOCKED', $to, $interval), 'error');
return $this->createRedirectResponse($current); }
When an attacker submits the password reset form at /admin/forgot with an invalid username, the application responds with:
Instructions to reset your password have been sent to your email address
However, when a valid username is supplied, and the attacker repeatedly triggers password reset requests, the application responds with:
Cannot reset password for <USEREMAIL>, password reset functionality temporarily blocked, please try later (maximum 60 minutes)
This discrepancy in responses enables: 1. User Enumeration – Attackers can determine if a username exists in the system by analyzing the response. 2. User Email Disclosure – The system discloses the actual email address associated with the account (e.g., admin@localhost.test).
This violates best practices for authentication flows, where responses should remain generic to avoid leaking sensitive information.
PoC 1. Navigate to the Forgot Password page: https://<target>/admin/forgot 1. Submit a reset request with a random/invalid username (e.g., invaliduser):
- Response: Instructions to reset your password have been sent to your email address 3. Submit a reset request with a valid username (e.g., admin). 4. Repeatedly request a reset for the same username until the lockout mechanism triggers. - Response: Cannot reset password for admin@localhost.test, password reset functionality temporarily blocked, please try later (maximum 60 minutes) 5. Observe the leaked email address of the admin account in the error message.
Impact - Severity: Medium - Type: Information Disclosure / User Enumeration - Who is Impacted: All Grav sites using Admin plugin v1.10.49.1 with password reset enabled. - Risks: - Allows attackers to enumerate valid usernames. - Exposes email addresses of admin accounts, which can be used in: - Credential stuffing - Password spraying - Phishing/social engineering campaigns - Further exploitation in combination with other vulnerabilities
Recommendation
- Modify the taskForgot() logic to always return a generic, non-identifying message, regardless of whether the username exists or rate limits are hit.
- Example safe response: ini If the account exists, password reset instructions will be sent.
- Do not include email addresses ($to) or other sensitive data in error messages.
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][metadata], data[header][taxonomy][category], and data[header][taxonomy][tag] parameters. These scripts are stored in the page frontmatter and executed automatically whenever the affected page is accessed or rendered in the administrative interface.
---
Details
Vulnerable Endpoint: POST /admin/pages/[page] Parameters:
- data[header][metadata] - data[header][taxonomy][category] - data[header][taxonomy][tag]
The application fails to properly sanitize user input when saving page metadata or taxonomy fields via the Admin Panel. As a result, an attacker with access to the admin interface can inject a malicious script using these parameters, and the script will be stored in the page's YAML frontmatter. When the page or metadata is rendered (especially in the Admin Panel), the payload is executed in the browser of any user with access.
---
PoC
Payload:
<script>alert('PoC-XXS51')</script>
Steps to Reproduce:
1. Log into the Grav Admin Panel and navigate to Pages. 2. Create or edit a page. 3. Inject the payload above into any of the following fields in the Options tab: - Metadata key name - Category under Taxonomy - Tag under Taxonomy !image
!image
4. Save the page. !image
When the page is loaded again in the Admin Panel or potentially on the frontend (depending on how the metadata is used), the script is executed, confirming the Stored XSS vulnerability.
---
Impact
Stored XSS vulnerabilities can result in serious consequences, including:
- Session hijacking: Attackers can steal authentication cookies or tokens - Malware delivery: Injected scripts can download malicious software - Credential theft: Fake input fields can capture usernames and passwords - Sensitive data exposure: Access to internal metadata and browser data - Administrative access compromise: Especially dangerous in admin-facing interfaces - Phishing attacks: Users can be redirected to external malicious sites - Reputation damage: Executing arbitrary scripts in trusted systems undermines credibility
by CVE-Hunters
Summary
A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter.
---
Details
Vulnerable Endpoint: GET /admin/pages/[page] Parameter: data[header][content][items]
The application fails to properly validate and sanitize user input in the data[header][content][items] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session.
---
PoC
Payload:
"><ImG sRc=x OnErRoR=alert('XSS-PoC3')>
1. Log in to the Grav Admin Panel and navigate to Pages. 2. Create a new page or edit an existing one. 3. In the Advanced > Blog Config > Items field (which maps to data[header][content][items]), insert the payload above.
!image
4. Save the page. 5. The malicious payload is reflected and rendered by the application without proper sanitization. The JavaScript code is immediately executed in the browser.
!image
---
Impact
Reflected cross-site scripting (XSS) attacks can have serious consequences, including:
- User actions: Attackers can perform actions on behalf of the user - Data theft: Sensitive information such as session cookies can be stolen - Account compromise: Attackers may impersonate legitimate users - Malicious code execution: Arbitrary JavaScript code can run in the user’s browser - Website defacement or misinformation: Malicious output may be injected visually - User redirection: Victims may be redirected to phishing or malicious websites
by CVE-Hunters
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[readableName] parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.
---
Details
Vulnerable Endpoint: POST /admin/accounts/groups/Grupo Parameter: data[readableName]
The application fails to properly validate and sanitize user input in the data[readableName] parameter. This lack of input handling allows attackers to inject arbitrary script content that is stored in the application and executed in the browser of any user who views the affected group configuration.
---
PoC
Payload:
<ScRipT>alert('PoC-XSS')</ScRipT>
1. Navigate to Accounts > Groups in the administrative panel. 2. Create a new group or edit an existing one. 3. In the Display Name field (data[readableName]), insert the payload above and save the changes.
!image
The following HTTP request was generated during this action: !image
4. Next, go to Accounts > Users and open any user profile.
!image
5. The malicious script is executed immediately in the browser when the page loads, confirming the existence of a Stored XSS vulnerability.
!image
---
Impact
Stored XSS vulnerabilities can result in serious consequences, including:
- Session hijacking: Attackers can steal authentication cookies or tokens - Malware delivery: Inserting scripts that download malicious content - Credential theft: Capturing usernames and passwords through injected forms - Sensitive data exposure: Accessing data stored in the browser or the application - Browser takeover: Executing arbitrary commands in the user’s session - Phishing attacks: Redirecting users to fake login or malicious sites - Website defacement: Altering page content shown to users - Reputational damage: Undermining trust in the platform or organization
by CVE-Hunters
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][template] parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view.
---
Details
Vulnerable Endpoint: POST /admin/pages/[page] Parameter: data[header][template]
The application fails to properly sanitize user input in the data[header][template] field, which is stored in the YAML frontmatter of the page. An attacker can inject JavaScript code using this field, and the payload is rendered and executed when the page is accessed, especially within the Admin Panel interface.
---
PoC
Payload:
<script>alert('PoC-XXS73')</script>
Steps to Reproduce:
1. Log in to the Grav Admin Panel and navigate to Pages. 2. Create a new page or edit an existing one. 3. In the Advanced > Template field (which maps to data[header][template]), insert the payload: !image
4. Save the page. 5. Return to the Pages section and click on the three-dot menu of the affected page: !image
6. The stored XSS payload is triggered, and the script is executed in the browser: !image ---
Impact
Stored XSS vulnerabilities can have serious consequences, including:
- Session hijacking: Capturing admin session cookies or tokens - Malware delivery: Executing scripts that load malicious resources - Credential theft: Creating fake login prompts to steal usernames/passwords - Data exposure: Reading sensitive metadata or page contents - Privilege escalation: Performing actions as an authenticated user - Website defacement: Altering visual or functional elements of the site - Reputation damage: Undermining user trust in the application
by CVE-Hunters