https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 05:37:14 +0000 https://cve.radiocsirt.org/vuln/cnvd-2025-30351 cnvd-2025-30351 https://cve.radiocsirt.org/vuln/cnvd-2025-30351 https://cve.radiocsirt.org/vuln/euvd-2026-262288 EUVD-2026-262288 https://cve.radiocsirt.org/vuln/euvd-2026-262288 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66301 <p>Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.</p> <p>Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-66301 https://cve.radiocsirt.org/vuln/ghsa-v8x2-fjv7-8hjh <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary Due to a broken access control vulnerability in the `/admin/pages/{page_name}` endpoint, an editor ( user with full permissions to pages ) can change the functionality of a form after submission.</p> <p>### Details Due to improper authorization checks when modifying critical fields on a POST request to `/admin/pages/{page_name}`, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the `data[_json][header][form]` which is the YAML frontmatter which includes the `process` section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities.</p> <p>### PoC</p> <p>- Have Admin and Form plugins installed - Connect to panel as admin, create user and give him permission for pages all - Now connect as that user and notice you cant edit any process field in the panel - Change anything in the content of the form and save - Intercept the request: </p> <p>- Now modify the field `data[_json][header][form] with the following payload URL-encoded not like this: ``` {&#34;name&#34;:&#34;ssti-test 2&#34;,&#34;fields&#34;:{&#34;name&#34;:{&#34;type&#34;:&#34;text&#34;,&#34;label&#34;:&#34;Name&#34;,&#34;required&#34;:true}},&#34;buttons&#34;:{&#34;submit&#34;:{&#34;type&#34;:&#34;submit&#34;,&#34;value&#34;:&#34;Submit&#34;}},&#34;process&#34;:[{&#34;message&#34;:&#34;{{ evaluate_twig(form.value(&#39;name&#39;)) }}&#34;}]} ```</p> <p>- Change the field and forward it:  can change the functionality of a form after submission.</p> <p>### Details Due to improper authorization checks when modifying critical fields on a POST request to `/admin/pages/{page_name}`, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the `data[_json][header][form]` which is the YAML frontmatter which includes the `process` section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities.</p> <p>### PoC</p> <p>- Have Admin and Form plugins installed - Connect to panel as admin, create user and give him permission for pages all - Now connect as that user and notice you cant edit any process field in the panel - Change anything in the content of the form and save - Intercept the request: </p> <p>- Now modify the field `data[_json][header][form] with the following payload URL-encoded not like this: ``` {&#34;name&#34;:&#34;ssti-test 2&#34;,&#34;fields&#34;:{&#34;name&#34;:{&#34;type&#34;:&#34;text&#34;,&#34;label&#34;:&#34;Name&#34;,&#34;required&#34;:true}},&#34;buttons&#34;:{&#34;submit&#34;:{&#34;type&#34;:&#34;submit&#34;,&#34;value&#34;:&#34;Submit&#34;}},&#34;process&#34;:[{&#34;message&#34;:&#34;{{ evaluate_twig(form.value(&#39;name&#39;)) }}&#34;}]} ```</p> <p>- Change the field and forward it: ![image](https://github.com/user…</p> https://cve.radiocsirt.org/vuln/ghsa-v8x2-fjv7-8hjh