CVE-2025-66312

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[readableName] parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 1.11.0-beta.1.

• CWE-79

• https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0Patch
• https://github.com/getgrav/grav/security/advisories/GHSA-rmw5-f87r-w988Exploit, Vendor Advisory
• https://github.com/getgrav/grav/security/advisories/GHSA-rmw5-f87r-w988Exploit, Vendor Advisory

Published

Dec 1, 2025

Last Modified

Sep 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66307This admin plugin for Grav is an HTML user interface that pr…5.3
• CVE-2025-66308This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66309This admin plugin for Grav is an HTML user interface that pr…6.1
• CVE-2025-6631A maliciously crafted PRT file, when parsed through certain …7.8
• CVE-2025-66310This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66311This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66313ChurchCRM is an open-source church management system. In Chu…7.2
• CVE-2025-66314Improper Privilege Management vulnerability in ZTE ElasticNe…7.5
• CVE-2025-66315There is a configuration defect vulnerability in the version…8.8
• CVE-2025-66319Permission control vulnerability in the resource scheduling …5.5
• CVE-2025-6632A maliciously crafted PSD file, when linked or imported into…7.8
• CVE-2025-66320Multi-thread race condition vulnerability in the camera fram…4.7