N0Tra4E

**Name of the Vulnerable Software and Affected Versions** Grav Email plugin versions prior to 4.2.2 **Description** An authenticated remote user with `api.access` and `api.pages.write` permissions can execute arbitrary operating-system commands as the account running PHP. This occurs because the plugin renders Email action parameters controlled by the page editor as unsandboxed Twig templates. An attacker can achieve this by placing a Twig expression in the `header.form.process.email.body` parameter, publishing the page, and submitting the form. Twig is a template engine used to generate HTML or other text formats dynamically. **Recommendations** Update Grav Email plugin to version 4.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Grav API Plugin versions prior to 1.0.0-beta.15 **Description** An insecure direct object reference and logic flaw in the `update()` function of the `UsersController` allows any authenticated user with basic `api.access` permissions to modify their own permission configuration. By sending a `PATCH` request to the user update endpoint, an attacker can overwrite the `access` variable to grant themselves Super Administrator privileges (`admin.super` and `api.super`). This vertical privilege escalation can lead to full system compromise and potential remote code execution (RCE) by allowing the attacker to modify configurations or upload malicious plugins. **Recommendations** Update Grav API Plugin to version 1.0.0-beta.15.