CVE-2025-66304

HighCVSS 7.2/10Last modified Sep 26, 2026

Description

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200 CWE-201

Affected software

No affected versions have been published.

Timeline

Published: Dec 1, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-663054.9Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu CVE-2025-663066.5Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS CVE-2025-663075.3This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663085.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663096.1This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-66317.8A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious a CVE-2025-663105.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663115.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663125.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Pr CVE-2025-663137.2ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handl CVE-2025-663147.5Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by AC CVE-2025-663158.8There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission setting