CVE-2026-115624

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

CVE-2026-115624

The GROWI platform is susceptible to a missing authorization check vulnerability within its collaborative editing feature . This flaw allows users with limited access—such as guest users , users with read-only permissions , or users in pending, suspended, or invited statuses —to bypass intended r...

CVE-2026-115624

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

CVE-2026-115624

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

CVE-2026-115624

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

EUVD-2026-111557

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

PT-2026-127728

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

CVE-2026-115624: GROWI, Inc. GROWI: GROWI contains a missing authorization check vulnerability in its collaborative editing feature

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

GROWI Labs GROWI authorization issue vulnerability

Growi Labs versions GROWI v7.0.0 through v8.0.6 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks in the collaborative editing functionality, potentially allowing users with read-only permissions—including guest users—or users in pending,...

EUVD-2022-39423

Malicious code in bioql PyPI...

CVE-2022-45012

A cross-site scripting XSS vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Source field...

PT-2024-37421

Name of the Vulnerable Software and Affected Versions: MegaBIP software versions through 5.12.1 Description: The issue allows an attacker to disclose the contents of the database, obtain session cookies, or modify the content of pages. Recommendations: For MegaBIP software versions through 5.12.1...

Cups Easy Cross-Site Script Vulnerabilities

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the currencyid parameter on the /cupseasylive/currencymodify.php page. An attacker coul...

Cups Easy Cross-Site Scripting Vulnerability

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. A cross-site scripting vulnerability exists in Cups Easy version 1.0, which stems from insufficient escaping of the description parameter on the /cupseasylive/unitofmeasurementmodify.php...

U.S. Department of State: HTML INJECTION on coins.state.gov

An HTML injection vulnerability was found on coins.state.gov, which could have allowed an attacker to modify the page and potentially steal a user's identity. The vulnerability was discovered through the use of the dalfox tool...

WBCE CMS Source Field Cross-Site Scripting Vulnerability

WBCE CMS is an open source content management system CMS based on PHP and MySQL. WBCE CMS v1.5.4 and its previous versions exist cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the Source field in the Modify Pa...

Cross site scripting

A cross-site scripting XSS vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Source field...

WBCE CMS Cross-Site Scripting Vulnerability

WBCE CMS is an open source content management system CMS based on PHP and MySQL. WBCE CMS v1.5.4 and its previous versions exist cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the Source field in the Modify Pa...

PT-2022-27367 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS version 1.5.4 Description: A cross-site scripting XSS issue in the Modify Page module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Source field. Recommendations: For WBCE CMS versi...

CVE-2022-45012: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Source field...