Grav CMS before 1.3.0 is vulnerable to cross-site scripting via system/src/Grav/Common/Twig/Twig.php and allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.
View the template here CVE-2018-5233.yaml
References:
http://www.openwall.com/lists/oss-security/2018/03/15/1