Alpetgexha

**Name of the Vulnerable Software and Affected Versions** getgrav/grav-plugin-comments versions prior to 1.2.11 **Description** The Comments plugin for Grav CMS registers an admin handler that returns comment data as JSON without performing an authentication check. The handler relies on the `isAdmin()` function, which only verifies if the admin service is registered on the current route instead of confirming the visitor's authentication status. This allows an unauthenticated remote attacker to access the `/admin/comments/page:<n>` endpoint and retrieve comments from the last 7 days, including commenter email addresses and the absolute server filesystem path of the data file. This issue affects sites using the classic Admin plugin with Comments enabled. **Recommendations** Update to version 1.2.11.

**Name of the Vulnerable Software and Affected Versions** Grav Data Manager versions 1.0.1 through 1.4.4 **Description** Stored data entries in the item-detail view `admin/templates/partials/item.html.twig` are rendered without proper escaping due to the use of Twig's `raw` filter. In certain instances, a `striptags('<br>')` call is used, which can be bypassed by PHP's `strip tags()` function by preserving allowed tags and their attributes. This allows an unauthenticated visitor to submit a front-end form and store an HTML payload. When an administrator views the entry in the classic admin panel, the payload executes as JavaScript within the administrator's session and origin, utilizing their privileges and CSRF token. Execution happens automatically for list values, such as checkbox or multi-select fields, and upon hovering for ordinary text fields. **Recommendations** Update Grav Data Manager to version 1.4.5.