Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
CVSS Score
5.4
EPSS Score
0.005
Published
2023-12-26
Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
CVSS Score
5.4
EPSS Score
0.005
Published
2023-12-26
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
CVSS Score
5.4
EPSS Score
0.005
Published
2023-12-26
Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.
CVSS Score
6.5
EPSS Score
0.001
Published
2022-10-24
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
CVSS Score
4.3
EPSS Score
0.001
Published
2022-04-05
growi is vulnerable to Authorization Bypass Through User-Controlled Key
CVSS Score
6.3
EPSS Score
0.002
Published
2022-01-12
Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.
CVSS Score
6.1
EPSS Score
0.003
Published
2021-09-21
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.
CVSS Score
9.1
EPSS Score
0.004
Published
2021-06-22
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors.
CVSS Score
6.5
EPSS Score
0.003
Published
2021-06-22
Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
CVSS Score
4.8
EPSS Score
0.003
Published
2021-03-10