PT-2025-51240
CVE-2025-66843
·
Published
2025-12-15
·
Updated
2025-12-17
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
grav versions prior to 1.7.49.5
Description
The software contains a Stored Cross-Site Scripting issue within the page editing functionality. An authenticated, low-privileged user who has permission to edit content can inject malicious JavaScript payloads into editable fields. This payload is stored on the server and executed when another user views or edits the affected page.
Recommendations
Update to version 1.7.49.5 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾