CVE-2025-66307

MediumCVSS 5.3/10Last modified Sep 26, 2026

Description

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering. This vulnerability is fixed in 1.11.0-beta.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

VendorProductVersions
getgravgrav< 1.11.0-beta.1

References

Timeline

Published
Dec 1, 2025
Last modified
Sep 26, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-663085.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. PrCVE-2025-663096.1This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. PrCVE-2025-66317.8A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious aCVE-2025-663105.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. PrCVE-2025-663115.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. PrCVE-2025-663125.4This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. PrCVE-2025-663137.2ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handlCVE-2025-663147.5Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACCVE-2025-663158.8There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission settingCVE-2025-663195.5Permission control vulnerability in the resource scheduling module. Impact: Successful exploitation of this vulnerability may affect serviceCVE-2025-66327.8A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious acCVE-2025-663204.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect a