CVE-2025-64059

—

CVSS 3.1

1.8 low

EPSS

—

Published

Sep 13, 2026 (2d ago)

Modified

Sep 14, 2026

Description

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.

Weakness: CWE-79
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (—)

In the news0 stories

No ingested article mentions this CVE yet.