CyberRota Analysis
AI-GeneratedGrav versions prior to 2.0.15 are vulnerable to a stored cross-site scripting (XSS) flaw in the audio and video media rendering process, specifically within the sourceParsedownElement method. This vulnerability allows attackers to inject malicious HTML and JavaScript into the application, which can execute in the context of users' sessions, potentially leading to data theft or session hijacking. Organizations utilizing Grav for content management should prioritize patching to mitigate the risk associated with this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.