CVE-2026-44737

grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.10.49.5, the application fails to properly validate and sanitize user input in the data[header][title] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session. This vulnerability is fixed in 1.10.49.5.

• CWE-79

• https://github.com/getgrav/grav-plugin-admin/commit/f67cc18e81d8767bb43d29ee6422c55ed0427803
• https://github.com/getgrav/grav/security/advisories/GHSA-fmg2-f5r9-24qc
• https://github.com/getgrav/grav/security/advisories/GHSA-fmg2-f5r9-24qc

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44731OpenProject is open-source, web-based project management sof…4.3
• CVE-2026-44732OpenProject is open-source, web-based project management sof…4.3
• CVE-2026-44733OpenProject is open-source, web-based project management sof…5.9
• CVE-2026-44734OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44735OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44736OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44738Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the …7.7
• CVE-2026-44739Pimcore is an Open Source Data & Experience Management Platf…8.7
• CVE-2026-4474A flaw has been found in itsourcecode University Management …6.1
• CVE-2026-44740Billy is an interface filesystem abstraction for Go. Prior t…6.5
• CVE-2026-44742Postorius through 1.3.13 does not escape HTML in the message…6.1
• CVE-2026-44743Under certain conditions, when an unauthorized attacker acce…3.7