Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
growi vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv2
CVE-2021-20619
Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote malicious users to inject an arbitrary script via unspecified vectors.
Weseek Growi
3.5
CVSSv2
CVE-2021-20667
Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and previous versions allows remote authenticated malicious users to inject an arbitrary script via a specially crafted content.
Weseek Growi
6.5
CVSSv2
CVE-2021-20669
Path traversal vulnerability in GROWI versions v4.2.2 and previous versions allows an attacker with administrator rights to read and/or delete an arbitrary path via a specially crafted URL.
Weseek Growi
5
CVSSv2
CVE-2021-20670
Improper access control vulnerability in GROWI versions v4.2.2 and previous versions allows a remote unauthenticated malicious user to read the user's personal information and/or server's internal information via unspecified vectors.
Weseek Growi
4.3
CVSSv2
CVE-2021-20672
Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote malicious users to inject an arbitrary script via unspecified vectors.
Weseek Growi
3.5
CVSSv2
CVE-2021-20673
Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated malicious users to inject an arbitrary script via unspecified vectors.
Weseek Growi
6.4
CVSSv2
CVE-2021-20736
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote malicious user to obtain and/or alter the information stored in the database via unspecified vectors.
Weseek Growi
4
CVSSv2
CVE-2021-20737
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote malicious user to view the unauthorized pages without access privileges via unspecified vectors.
Weseek Growi
5
CVSSv2
CVE-2019-13338
In WESEEK GROWI prior to 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field.
Weseek Growi
NA
CVE-2023-42436
Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Weseek Growi
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48654
CVE-2024-2757
authentication bypass
CVE-2024-3194
CVE-2024-33640
CVE-2024-21111
dos
insecure direct object reference
CVE-2024-21345
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »