Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
growi vulnerabilities and exploits
(subscribe to this query)
4
CVSSv2
CVE-2021-20668
Path traversal vulnerability in GROWI versions v4.2.2 and previous versions allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL.
Weseek Growi
6.5
CVSSv2
CVE-2021-20669
Path traversal vulnerability in GROWI versions v4.2.2 and previous versions allows an attacker with administrator rights to read and/or delete an arbitrary path via a specially crafted URL.
Weseek Growi
5
CVSSv2
CVE-2021-20670
Improper access control vulnerability in GROWI versions v4.2.2 and previous versions allows a remote unauthenticated malicious user to read the user's personal information and/or server's internal information via unspecified vectors.
Weseek Growi
4.3
CVSSv2
CVE-2021-20672
Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote malicious users to inject an arbitrary script via unspecified vectors.
Weseek Growi
3.5
CVSSv2
CVE-2021-20673
Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated malicious users to inject an arbitrary script via unspecified vectors.
Weseek Growi
6.4
CVSSv2
CVE-2021-20736
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote malicious user to obtain and/or alter the information stored in the database via unspecified vectors.
Weseek Growi
4
CVSSv2
CVE-2021-20737
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote malicious user to view the unauthorized pages without access privileges via unspecified vectors.
Weseek Growi
4.3
CVSSv2
CVE-2021-20829
Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and previous versions allows remote malicious users to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.
Weseek Growi
NA
CVE-2023-49598
Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Weseek Growi
NA
CVE-2023-49779
Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Weseek Growi
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injection
CVE-2006-4304
CVE-2023-26603
CVE-2024-28327
CVE-2023-50363
CVE-2024-21905
template injection
CVE-2024-3400
cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »