Weseek

Growi

42 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2023-49598

  • EPSS 0.49%
  • Published 26.12.2023 08:15:10
  • Last modified 21.11.2024 08:33:37

Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site usi...

5.4

CVE-2023-45737

  • EPSS 0.45%
  • Published 26.12.2023 08:15:09
  • Last modified 21.11.2024 08:27:16

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the ...

5.4

CVE-2023-42436

  • EPSS 0.45%
  • Published 26.12.2023 08:15:09
  • Last modified 21.11.2024 08:22:31

Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the pro...

6.5

CVE-2022-41799

  • EPSS 0.1%
  • Published 24.10.2022 14:15:52
  • Last modified 07.05.2025 17:15:57

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by t...

6.5

CVE-2022-1236

  • EPSS 0.14%
  • Published 05.04.2022 09:15:07
  • Last modified 21.11.2024 06:40:19

Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.

7.5

CVE-2021-3852

Exploit
  • EPSS 0.2%
  • Published 12.01.2022 11:15:08
  • Last modified 21.11.2024 06:22:39

growi is vulnerable to Authorization Bypass Through User-Controlled Key

6.1

CVE-2021-20829

  • EPSS 0.33%
  • Published 21.09.2021 10:15:07
  • Last modified 21.11.2024 05:47:14

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.

6.5

CVE-2021-20737

  • EPSS 0.26%
  • Published 22.06.2021 02:15:07
  • Last modified 21.11.2024 05:47:06

Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors.

9.1

CVE-2021-20736

  • EPSS 0.35%
  • Published 22.06.2021 02:15:07
  • Last modified 21.11.2024 05:47:06

NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.

4.8

CVE-2021-20673

  • EPSS 0.26%
  • Published 10.03.2021 10:15:13
  • Last modified 21.11.2024 05:46:59

Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.