https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:45:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-379584 EUVD-2026-379584 https://cve.radiocsirt.org/vuln/euvd-2026-379584 https://cve.radiocsirt.org/vuln/fkie_cve-2026-92916 <p>Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest() intercepts any path containing /__clockwork/ during bootstrap and passes it to Debugger::debuggerRequest(), which performs no user lookup, IP restriction, or Clockwork authenticator check, and also supports anonymous pagination over the entire stored history. With the shipped censored: false default, each stored record contains raw request cookies (including Grav&#39;s session cookie, whose value is the PHP session id, allowing an attacker to resume another user&#39;s session, including an authenticated admin&#39;s), the full parsed request body (Grav&#39;s login form posts data[username]/data[password], so passwords are stored in plaintext because Clockwork&#39;s password filter only inspects top-level keys), and the site&#39;s entire system and plugin configuration, including operator-saved secrets such as SMTP credentials, third-party API keys, and licence keys. Authorization and X-API-Token headers are stored even when censored: true. On Grav 2.0, setting provider: debugbar does not avoid the issue because Grav forces the Clockwork provider for requests preferring a JSON response. The issue is fixed in 1.7.53.4 and 2.0.22, which restrict /__clockwork/ to server-local requests or requests presenting the new system.debu…</p> <p>Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest() intercepts any path containing /__clockwork/ during bootstrap and passes it to Debugger::debuggerRequest(), which performs no user lookup, IP restriction, or Clockwork authenticator check, and also supports anonymous pagination over the entire stored history. With the shipped censored: false default, each stored record contains raw request cookies (including Grav&#39;s session cookie, whose value is the PHP session id, allowing an attacker to resume another user&#39;s session, including an authenticated admin&#39;s), the full parsed request body (Grav&#39;s login form posts data[username]/data[password], so passwords are stored in plaintext because Clockwork&#39;s password filter only inspects top-level keys), and the site&#39;s entire system and plugin configuration, including operator-saved secrets such as SMTP credentials, third-party API keys, and licence keys. Authorization and X-API-Token headers are stored even when censored: true. On Grav 2.0, setting provider: debugbar does not avoid the issue because Grav forces the Clockwork provider for requests preferring a JSON response. The issue is fixed in 1.7.53.4 and 2.0.22, which restrict /__clockwork/ to server-local requests or requests presenting the new system.debu…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-92916 https://cve.radiocsirt.org/vuln/ghsa-q3g2-wjhw-4rmj <p>Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest() intercepts any path containing /__clockwork/ during bootstrap and passes it to Debugger::debuggerRequest(), which performs no user lookup, IP restriction, or Clockwork authenticator check, and also supports anonymous pagination over the entire stored history. With the shipped censored: false default, each stored record contains raw request cookies (including Grav&#39;s session cookie, whose value is the PHP session id, allowing an attacker to resume another user&#39;s session, including an authenticated admin&#39;s), the full parsed request body (Grav&#39;s login form posts data[username]/data[password], so passwords are stored in plaintext because Clockwork&#39;s password filter only inspects top-level keys), and the site&#39;s entire system and plugin configuration, including operator-saved secrets such as SMTP credentials, third-party API keys, and licence keys. Authorization and X-API-Token headers are stored even when censored: true. On Grav 2.0, setting provider: debugbar does not avoid the issue because Grav forces the Clockwork provider for requests preferring a JSON response. The issue is fixed in 1.7.53.4 and 2.0.22, which restrict /__clockwork/ to server-local requests or requests presenting the new system.debu…</p> <p>Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest() intercepts any path containing /__clockwork/ during bootstrap and passes it to Debugger::debuggerRequest(), which performs no user lookup, IP restriction, or Clockwork authenticator check, and also supports anonymous pagination over the entire stored history. With the shipped censored: false default, each stored record contains raw request cookies (including Grav&#39;s session cookie, whose value is the PHP session id, allowing an attacker to resume another user&#39;s session, including an authenticated admin&#39;s), the full parsed request body (Grav&#39;s login form posts data[username]/data[password], so passwords are stored in plaintext because Clockwork&#39;s password filter only inspects top-level keys), and the site&#39;s entire system and plugin configuration, including operator-saved secrets such as SMTP credentials, third-party API keys, and licence keys. Authorization and X-API-Token headers are stored even when censored: true. On Grav 2.0, setting provider: debugbar does not avoid the issue because Grav forces the Clockwork provider for requests preferring a JSON response. The issue is fixed in 1.7.53.4 and 2.0.22, which restrict /__clockwork/ to server-local requests or requests presenting the new system.debu…</p> https://cve.radiocsirt.org/vuln/ghsa-q3g2-wjhw-4rmj