CVE-2023-50332

Improper authorization vulnerability exists in the User Management /admin/users page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user's intention...

CVE-2023-50332

GROWI contains an improper authorization vulnerability (CVE-2023-50332) on the User Management page (/admin/users) that could allow a user to delete or suspend their own account in versions prior to 6.0.6. Root cause is an authorization flaw in the /admin/users endpoint. The issue is documented a...

CVE-2023-50294

The App Settings /admin/app page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page...

CVE-2023-50294

The CVE-2023-50294 issue affects GROWI prior to v6.0.6, where the App Settings page (/admin/app) stores the Secret access key in cleartext. An attacker who can access this page could obtain the external service secret key. The Red Hat, NVD, OSV, and JVN entries corroborate this vulnerability and ...

CVE-2023-50175

Stored cross-site scripting vulnerability exists in the App Settings /admin/app page, the Markdown Settings /admin/markdown page, and the Customize /admin/customize page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser o...

CVE-2023-50175

GROWI has a stored XSS vulnerability (CVE-2023-50175) affecting App Settings (/admin/app), Markdown Settings (/admin/markdown), and Customize (/admin/customize) pages in versions prior to v6.0.0. The underlying issue allows arbitrary script execution in a user’s browser when visiting the site. Re...

CVE-2023-50175

Stored cross-site scripting vulnerability exists in the App Settings /admin/app page, the Markdown Settings /admin/markdown page, and the Customize /admin/customize page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser o...

CVE-2023-49807

CVE-2023-49807 is a stored XSS in GROWI when processing MathJax, affecting GROWI versions prior to 6.0.0. Exploitation could cause arbitrary script execution in a user’s browser after visiting the site (web app context). The connected sources (NVD, Red Hat, JVN, OSV, PRION/PTSecurity) confirm the...

CVE-2023-49807

Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-49779

Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-49779

CVE-2023-49779 is a stored cross-site scripting vulnerability in the anchor tag of GROWI prior to v6.0.0. The issue allows an arbitrary script to run in the browser of users who access the affected site. Affected product: GROWI (WESEEK). Root cause: XSS in the anchor tag across multiple reference...

CVE-2023-49598

Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-49598

CVE-2023-49598 is a stored cross-site scripting (XSS) vulnerability in GROWI’s pre tag event handlers, affecting versions prior to v6.0.0. An attacker could have arbitrary script execution in a user’s browser who visits the affected site. The issue is documented across multiple sources (e.g., Red...

CVE-2023-49119

Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-49119

GROWI contains a stored XSS vulnerability (CVE-2023-49119) via img tags in versions prior to 6.0.0. An attacker could execute arbitrary JavaScript in a user’s browser when visiting a compromised page. The issue is confirmed in multiple sources (Red Hat, OSV, JVN, CNA entries) and is listed among ...

CVE-2023-49119

Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-47215

CVE-2023-47215 is a stored cross-site scripting vulnerability affecting WESEEK GROWI prior to version 6.0.0. The issue arises from the XSS Filter behavior and can allow arbitrary script execution in a user’s browser when visiting the site. Multiple sources (NVD/Red Hat/JVN/PT-Security CNNVD) cons...

CVE-2023-47215

Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-46699

Cross-site request forgery CSRF vulnerability exists in the User settings /me page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention...

CVE-2023-46699

GROWI versions prior to v6.0.0 are affected by a CSRF vulnerability on the User settings page (/me). If a logged-in user views a malicious page, settings may be changed without the user’s intention (UI:R, S:U, I:L). The issue is confirmed across multiple sources (CVE-2023-46699) with remediation ...