CVE-2026-75828
CRITICAL
INFO
Priority: 0.04
BB Relevance:
59/100
Published: 2026-08-18
Modified: 2026-10-22
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Passive
S:
X
AT:
None
VC:
High
VI:
High
VA:
None
Description
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.