Product by Getgrav

    Grav-plugin-login

    7 known vulnerabilities in Grav-plugin-login (Getgrav), 0 of them actively exploited (CISA KEV).

    Key figures

    7

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Grav-plugin-login (Getgrav)
    HighCVE-2026-109313

    Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie

    		8.1
    HighCVE-2026-109312

    Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

    		8.1
    HighCVE-2026-114658

    Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite

    		8.8
    HighCVE-2026-109314

    Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page

    		7.3
    HighCVE-2026-62669

    Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

    also in 1 other product

    		7.4
    CriticalCVE-2026-72699

    Grav Login Plugin before 3.9.1 Email Enumeration via Registration

    		5.3
    MediumCVE-2026-62671

    Getgrav Grav-plugin-login: Cross-Site Request Forgery (CSRF)

    		5.4

    All products by Getgrav