https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:07:30 +0000 https://db.gcve.eu/vuln/cve-2026-72832 <p><strong>Affected:</strong> getgrav grav</p> <p>Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `&lt;` and uses `[^&gt;]*?`, which cannot cross the first literal `&gt;`; when a `&gt;` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `&lt;img src=x title=&#34;&gt;&#34; onerror=alert(document.domain)&gt;`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.</p> <p><strong>Affected:</strong> getgrav grav</p> <p>Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `&lt;` and uses `[^&gt;]*?`, which cannot cross the first literal `&gt;`; when a `&gt;` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `&lt;img src=x title=&#34;&gt;&#34; onerror=alert(document.domain)&gt;`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.</p> https://db.gcve.eu/vuln/cve-2026-72832