https://vulnerability.circl.lu/sightings/feed 2026-10-09T09:32:49.436682+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/27aded79-ad57-4645-85d8-4577ec73f2fc/export 2026-10-09T09:32:49.467025+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "27aded79-ad57-4645-85d8-4577ec73f2fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75828", "type": "seen", "source": "https://gist.github.com/alon710/921970bf6a85809e6ae612195bf792e8", "content": "# CVE-2026-75828: CVE-2026-75828: Stored Cross-Site Scripting (XSS) via Security Filter Bypass in Grav CMS\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75828\n\n## Summary\nCVE-2026-75828 is a critical stored cross-site scripting (XSS) vulnerability in the getgrav Grav CMS before version 2.0.15. The vulnerability resides in the detectXss() security filter mechanism, where parser-differential mismatches between the regular-expression-based server-side validation and browser HTML5 tokenization allow authenticated editors to bypass event-handler detection and inject arbitrary JavaScript execution vectors.\n\n## TL;DR\nA parser-differential flaw in Grav CMS's detectXss() filter allows authenticated editors to bypass event-handler detection using unpaired quotes in unquoted attribute values, resulting in stored cross-site scripting.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Score**: 9.3 (Critical)\n- **EPSS Score**: 0.00343\n- **Impact**: Stored Cross-Site Scripting (XSS) leading to Session Hijacking / RCE\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS\n- **grav**: < 2.0.15 (Fixed in: `2.0.15`)\n\n## Mitigation\n\n- Upgrade the Grav Core installation to version 2.0.15 or higher.\n- Apply the regex hotfix to system/src/Grav/Common/Security.php to anchor quote matching to the assignment operator.\n- Implement Web Application Firewall (WAF) inspection to reject payload sequences containing malformed HTML tags.\n\n**Remediation Steps:**\n1. Navigate to the Grav root directory on the hosting server.\n2. Execute the CLI self-upgrade command: bin/gpm self-upgrade\n3. Verify the version in system/src/Grav/Common/Security.php to ensure the updated regex configurations are active.\n\n## References\n\n- [Grav GitHub Security Advisory](https://github.com/getgrav/grav/security/advisories/GHSA-vfmf-q6x9-cw96)\n- [VulnCheck Third-Party Advisory](https://www.vulncheck.com/advisories/grav-before-stored-xss-via-detectxss-quote-bypass)\n- [Grav Core Security Fix Commit](https://github.com/getgrav/grav/commit/d5f89d95d94cc155bc3be998ee85527a7be073dd)\n- [Raw Git Patch Reference](https://github.com/getgrav/grav/commit/d5f89d95d94cc155bc3be998ee85527a7be073dd.patch)\n- [Official CVE Entry](https://www.cve.org/CVERecord?id=CVE-2026-75828)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T01:31:36.584153Z"} 2026-09-18T01:31:36.584153+00:00 https://vulnerability.circl.lu/sighting/df3eb523-900e-4f4d-8972-01b6cf201318/export 2026-10-09T09:32:49.469335+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "df3eb523-900e-4f4d-8972-01b6cf201318", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75828", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtefbit4x62j", "content": "\ud83d\udea8 CVE-2026-75828 \u2014 CVSS 9.3 CRITICAL\n\nGrav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where u...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75828\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T14:07:34.902164Z"} 2026-08-18T14:07:34.902164+00:00 https://vulnerability.circl.lu/sighting/da892349-f372-49c8-b2e0-2b5af85f0c9d/export 2026-10-09T09:32:49.469439+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "da892349-f372-49c8-b2e0-2b5af85f0c9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75828", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtedqdnqzd23", "content": "CVE-2026-75828 - grav\nGrav, a content management system, has a security flaw that lets attackers inject malicious code into pages. This could allow them to take control of visitors' browsers, potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grav #getgrav #CVE #infosec", "creation_timestamp": "2026-08-18T13:40:05.120679Z"} 2026-08-18T13:40:05.120679+00:00