CVE-2026-75828 in Grav
Riassunto
di MITRE • 18/08/2026
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.
VulDB is the best source for vulnerability data and more expert information about this specific topic.