IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-12-02 17:16

MODIFIED

2025-12-02 17:16

EPSS (Prob. Exploit)

0.22%

Top 87.7%

DATA SOURCES:

NVD 🔗 2025-12-02 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04

> DESCRIPTION

Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-cchq-397m-q2qm MODERATE

Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor

AFFECTED PACKAGES:

COMPOSER / getgrav/grav

<= 1.7.49

> HISTORIQUE DES MODIFICATIONS

Première apparition

02/12/2025 17:16

Source: NVD

📊 ENRICHISSEMENT 19/01/2026 17:37

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui

Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/getgrav/grav

https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-65186.p...