Grav 代码注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.cnvd.org.cn/flaw/show/CNVD-2021-33241
• https://avd.aliyun.com/detail?id=AVD-2024-28116
• https://cve.imfht.com/detail/CVE-2024-28116
• https://avd.aliyun.com/detail?id=AVD-2023-34448
• https://rivers.chaitin.cn/blog/cq950910lnechd244f6g
• https://github.com/gunzf0x/Grav-CMS-RCE-Authenticated
• https://avd.aliyun.com/detail?id=AVD-2023-34251
• https://www.exploit-db.com/exploits/49961
• https://github.com/getgrav/grav/security/advisories/GHSA-858q-77wx-hhx6
• https://www.sonarsource.com/blog/grav-cms-code-execution-vulnerabilities
• https://www.invicti.com/web-application-vulnerabilities/grav-cms-unauthenticated-rce-cve-2021-21425
• https://github.com/advisories/GHSA-wqvw-453m-rjm2
• https://nvd.nist.gov/vuln/detail/CVE-2025-50286
• https://www.exploit-db.com/exploits/52402
• https://tantosec.com/blog/grav/
• https://ethicalhacking.uk/authenticated-server-side-template-injection-with-sandbox-bypass-in-grav-cms/

Related Vulnerabilities

• PoCCVE-2026-41042: Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution
• PoCCVE-2026-4020: Gravity SMTP WordPress Plugin - Sensitive Information Exposure
• PoCwp-gravity-forms-log-disclosure: WordPress Gravity Forms - Log File Disclosure
• PoCCVE-2014-4536: Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting
• PoCCVE-2015-4455: WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload
• PoCCVE-2016-1000139: WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting
• PoCCVE-2018-5233: Grav CMS <1.3.0 - Cross-Site Scripting
• PoCCVE-2020-11529: Grav < 1.7 - Open Redirect
• PoCgravatar-secure-csp-bypass: Content-Security-Policy Bypass - Gravatar Secure
• PoCgrav-register-admin: Grav Register Admin User - Detect
• WordPress plugin GravatarLocalCache 跨站请求伪造漏洞
• Grav CMS CVE-2024-28116 服务端模板注入漏洞
• Grav CMS CVE-2024-27921 目录遍历漏洞