Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

getgrav Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-92917`Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r	Exploitation statusNot confirmed	FixYes	Affected productgrav	Published09/17/2026	SeverityHigh
`CVE-2026-92916`Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork	Exploitation statusNot confirmed	FixYes	Affected productgrav	Published09/17/2026	SeverityHigh
`CVE-2025-64059`	Exploitation statusPublic exploit	FixNot confirmed	Affected productgrav	Published09/13/2026	SeverityLow
`CVE-2026-86197`Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published09/05/2026	SeverityMedium
`CVE-2026-86196`Grav API Plugin before 1.0.20 Authentication Bypass via Host Header	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-api	Published09/05/2026	SeverityHigh
`CVE-2026-86195`grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-api	Published09/05/2026	SeverityHigh
`CVE-2026-86194`Grav Form Plugin before 9.1.22 Cross-Page Form Execution	Exploitation statusNot known exploited	FixYes	Affected productgrav-plugin-form	Published09/05/2026	SeverityMedium
`CVE-2026-86193`Grav API Plugin Authentication Bypass via Group-Inherited Super	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-api	Published09/05/2026	SeverityHigh
`CVE-2026-85604`Grav before 2.0.18 Remote Code Execution via sort filter	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published09/04/2026	SeverityHigh
`CVE-2026-85603`Grav Admin Plugin Path Traversal via Save As Language Code	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published09/04/2026	SeverityHigh
`CVE-2026-85602`Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-form	Published09/04/2026	SeverityCritical
`CVE-2026-85601`Grav Admin before 2.0.20 Cross-Site Scripting via marked.js	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published09/04/2026	SeverityMedium
`CVE-2026-85600`Grav Admin before 2.0.21 Stored XSS via username	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-admin2	Published09/04/2026	SeverityMedium
`CVE-2026-85599`Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-shortcode-core	Published09/04/2026	SeverityMedium
`CVE-2026-85598`Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published09/04/2026	SeverityMedium
`CVE-2026-80204`Grav before 1.0.18 Authentication Bypass via Scoped API Key	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/26/2026	SeverityCritical
`CVE-2026-80203`Grav before 1.0.18 Authentication Bypass via Scoped API Key	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/26/2026	SeverityCritical
`CVE-2026-76846`Grav before 2.0.16 Information Disclosure via Twig Sandbox	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-76839`Grav before 2.0.16 Information Disclosure via offsetGet	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-75574`Grav before 4.2.2 Remote Code Execution via Email Twig	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-72702`Grav CMS before 2.0.16 Origin Validation Bypass via Referer	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/25/2026	SeverityCritical
`CVE-2026-72701`Grav CMS before 2.0.16 Timing Attack via verifyNonce	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/25/2026	SeverityMedium
`CVE-2026-72700`Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-72699`Grav Login Plugin before 3.9.1 Email Enumeration via Registration	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-login	Published08/25/2026	SeverityCritical
`CVE-2026-72698`Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-72697`Grav CMS before 2.0.16 Path Traversal via media_directory	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-72696`Grav CMS before 2.0.16 Symlink Following via createLockFile	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-72695`Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-56710`Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/25/2026	SeverityCritical
`CVE-2026-56709`Grav before 3.9.2 Host Header Injection via sendInvitationEmail	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-56708`Grav API Plugin before 1.0.16 SSRF via DNS Rebinding	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/25/2026	SeverityMedium
`CVE-2026-56707`Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/25/2026	SeverityHigh
`CVE-2026-64852`Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-api	Published08/19/2026	SeverityHigh
`CVE-2026-64850`Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/19/2026	SeverityHigh
`CVE-2026-64851`Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-shortcode-core	Published08/19/2026	SeverityHigh
`CVE-2026-63408`Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter	Exploitation statusNot known exploited	FixYes	Affected productgrav-plugin-api	Published08/19/2026	SeverityHigh
`CVE-2026-63407`Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses	Exploitation statusNot known exploited	FixYes	Affected productgrav-plugin-api	Published08/19/2026	SeverityHigh
`CVE-2026-62671`CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-login	Published08/19/2026	SeverityMedium
`CVE-2026-62673`Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/19/2026	SeverityHigh
`CVE-2026-62672`Grav: Authenticated ReDoS via regex_replace in Twig Sandbox	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/19/2026	SeverityMedium
`CVE-2026-62667`Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-api	Published08/19/2026	SeverityHigh
`CVE-2026-62669`Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/19/2026	SeverityHigh
`CVE-2026-62666`Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super	Exploitation statusNot known exploited	FixYes	Affected productgrav-plugin-api	Published08/19/2026	SeverityHigh
`CVE-2026-62668`Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/19/2026	SeverityCritical
`CVE-2026-62670`Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)	Exploitation statusNot known exploited	FixYes	Affected productgrav-plugin-flex-objects	Published08/19/2026	SeverityMedium
`CVE-2026-61842`Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/19/2026	SeverityMedium
`CVE-2026-61690`Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/19/2026	SeverityMedium
`CVE-2026-61607`Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-api	Published08/19/2026	SeverityMedium
`CVE-2026-53654`Grav: Unauthenticated open redirect via login twofa_cancel _redirect	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/19/2026	SeverityMedium
`CVE-2026-75837`Grav before 2.0.14 Privilege Escalation via Group Access Field	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/18/2026	SeverityCritical
`CVE-2026-75836`Grav API Plugin before 1.0.14 Missing Authorization	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/18/2026	SeverityHigh
`CVE-2026-75835`Grav API Plugin before 1.0.14 Missing Authorization	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/18/2026	SeverityCritical
`CVE-2026-75834`Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/18/2026	SeverityMedium
`CVE-2026-75833`Grav API Plugin Open Redirect via Backslash Bypass	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/18/2026	SeverityHigh
`CVE-2026-75832`Grav API Plugin before 1.0.14 Authorization Bypass	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/18/2026	SeverityCritical
`CVE-2026-75831`Grav before 2.0.15 Stored XSS via audio/video source URL	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/18/2026	SeverityMedium
`CVE-2026-75830`grav-plugin-api before 1.0.15 Path Traversal via batchCopy	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/18/2026	SeverityHigh
`CVE-2026-75829`grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/18/2026	SeverityHigh
`CVE-2026-75828`Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/18/2026	SeverityCritical
`CVE-2026-75827`Grav before 2.0.15 Arbitrary File Write via error_log	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/18/2026	SeverityCritical
`CVE-2026-75107`Grav Form Plugin before 9.1.19 Stored XSS via Field Properties	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/18/2026	SeverityMedium
`CVE-2026-74908`Grav plugin-api before 1.0.15 Script Injection via SVG	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/18/2026	SeverityMedium
`CVE-2026-74907`Grav before 2.0.15 Path Traversal via plugin-asset-map.php	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/18/2026	SeverityHigh
`CVE-2026-72833`Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72832`Grav before 2.0.12 Stored XSS via quoted-attribute bypass	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityMedium
`CVE-2026-72831`Grav through 2.0.11 Authentication Bypass via Flex Objects	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72830`Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72829`Grav before 1.0.13 API Key Scope Bypass via UsersController	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72828`Grav before 1.0.13 API Key Scope Bypass via InvitationsController	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72827`Grav CMS before 2.0.13 Remote Code Execution via Twig	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72826`Grav before 1.0.13 Scope Bypass via createApiKey	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72825`Grav before 1.0.13 API-key scope cap bypass via ReportsController	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72824`Grav before 1.0.13 API Key Scope Bypass via PagesController	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72823`Grav before 1.0.13 API-key scope cap bypass via DemoController	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/14/2026	SeverityMedium
`CVE-2026-72822`Grav before 1.0.13 Authentication Bypass via disable2fa	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-72821`Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityMedium
`CVE-2026-72820`Grav 2.0.11 Path Traversal via Backup Profile Configuration	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityMedium
`CVE-2026-72819`Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/14/2026	SeverityHigh
`CVE-2026-69089`Grav CMS before 2.0.11 Path Traversal via watermark	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/03/2026	SeverityHigh
`CVE-2026-69088`Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published08/03/2026	SeverityHigh
`CVE-2026-69087`Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig	Exploitation statusPublic exploit	FixYes	Affected productgrav-plugin-form	Published08/03/2026	SeverityHigh
`CVE-2026-66400`Grav Login Plugin before 3.8.13 Insufficient Session Expiration	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/29/2026	SeverityMedium
`CVE-2026-65897`Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/23/2026	SeverityHigh
`CVE-2026-65896`Grav API Plugin before 1.0.10 Path Traversal via move	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/23/2026	SeverityHigh
`CVE-2026-65895`Grav API Plugin before 1.0.10 Broken Access Control	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/23/2026	SeverityHigh
`CVE-2026-65608`Grav before 2.0.9 Remote Code Execution via FlexDirectory	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/23/2026	SeverityHigh
`CVE-2026-65603`Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/22/2026	SeverityHigh
`CVE-2026-65008`Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/21/2026	SeverityCritical
`CVE-2026-65007`Grav before 1.0.8 Missing Authorization on API Key Generation	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/21/2026	SeverityHigh
`CVE-2026-64628`Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/21/2026	SeverityMedium
`CVE-2026-62387`Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/17/2026	SeverityHigh
`CVE-2026-62386`Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/17/2026	SeverityHigh
`CVE-2026-62237`Grav < 2.0.4 ReDoS via regex_replace in Sandbox	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/17/2026	SeverityMedium
`CVE-2026-62236`grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/17/2026	SeverityLow
`CVE-2026-62235`Grav Flex-Objects < 1.4.3 Authorization Bypass via API	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published07/17/2026	SeverityLow
`CVE-2026-62234`Grav < 2.0.4 SSRF via Unrestricted cURL Protocols	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/17/2026	SeverityHigh
`CVE-2026-62233`grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey	Exploitation statusNot known exploited	FixYes	Affected productgrav	Published07/17/2026	SeverityHigh
`CVE-2026-62232`Grav < 2.0.4 2FA Bypass via Secret Regeneration	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/17/2026	SeverityCritical
`CVE-2026-62231`Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/17/2026	SeverityHigh
`CVE-2026-62230`Grav < 2.0.4 File Access Bypass via Case Variation	Exploitation statusPublic exploit	FixYes	Affected productgrav	Published07/17/2026	SeverityHigh