Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
CVSS Score
5.4
EPSS Score
0.005
Published
2023-12-26
Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
CVSS Score
5.4
EPSS Score
0.005
Published
2023-12-26
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
CVSS Score
5.4
EPSS Score
0.005
Published
2023-12-26
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
CVSS Score
4.3
EPSS Score
0.001
Published
2022-04-05
growi is vulnerable to Authorization Bypass Through User-Controlled Key
CVSS Score
6.3
EPSS Score
0.002
Published
2022-01-12
Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.
CVSS Score
6.1
EPSS Score
0.003
Published
2021-09-21
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.
CVSS Score
9.1
EPSS Score
0.004
Published
2021-06-22
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors.
CVSS Score
6.5
EPSS Score
0.003
Published
2021-06-22
Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content.
CVSS Score
5.4
EPSS Score
0.002
Published
2021-03-10
Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL.
CVSS Score
2.7
EPSS Score
0.003
Published
2021-03-10