CVE-2021-47812 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the sch…
Critical CVSS: 9.3

CVE-2021-47812

GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution.
Vendor
Getgrav
Product
Grav
CWE
CWE-862
Yayın Tarihi
2026-01-16 00:16:26
Güncelleme
2026-02-02 16:16:15
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-

Kategoriler

CWE-862 Grav CRITICAL Getgrav 2026

Referanslar

https://getgrav.org https://www.exploit-db.com/exploits/49973 https://www.vulncheck.com/advisories/gravcms-arbitrary-yaml-writeupdate-unauthenticated https://www.exploit-db.com/exploits/49973