Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
62 results · page 1 of 2
Oct 27, 2026GROWI contains a missing authorization check vulnerability in its collaborative editing feature.CVE-2026-115624 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 6.9
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key.CVE-2026-109848 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpLow 2.3
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key.CVE-2026-105272 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpLow 2.3
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected prCVE-2026-100727 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 6.9
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026yutu is an AI-powered toolkit for managing and growing YouTube channels.CVE-2026-50158 · Other software · eat-pray-ai · reported by GitHubHigh 7.7
yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parameter through cmd/caption/download.go and passes it to Caption.Download() in pkg/caption/caption.go, where os.Create() creates or truncates that path without using the pkg.Root confinement boundary backed by YUTU_ROOT. A principal able to invoke caption-download, including a local HTTP client when the MCP server runs with its default authentication-disabled configuration, can write downloaded caption bytes to any path writable by the yutu process outside YUTU_ROOT. This can overwrite application files, configuration, shell startup files, logs, or data and can cause persistent code execution or denial of service depending on the selected writable target. Live caption retrieval also requires usable service credentials and an accessible caption identifier. This issue is fixed in version 0.10.9.
- Product
- yutu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revisiCVE-2026-84205 · Other software · growilabs · reported by VulnCheckHigh 7.1
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
- Product
- growi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions.CVE-2026-84204 · Other software · growilabs · reported by VulnCheckHigh 7.1
GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.
- Product
- growi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026GROWI contains an incorrect authorization vulnerability.CVE-2026-68951 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 6.9
GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs.CVE-2026-53620 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 5.3
GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user.CVE-2026-80191 · Other software · GROWI, Inc. · reported by VulnCheckHigh 8.7
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries no session skips the check entirely and the handler returns the file. The routes reached this way, /attachment/:id and /download/:id, take the attachment identifier from the path, so an unauthenticated caller who has an attachment identifier receives the file regardless of whether the page owning it is private and regardless of whether that caller would be permitted to view the page. Identifiers can be retained by a user whose access was later removed, or recovered from anywhere the identifier was previously exposed. Version 8.0.2 runs the check for authenticated and unauthenticated requests alike, skipping it only where a valid share link has already bound the requested file to that link's page.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email servCVE-2026-41951 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpHigh 8.6
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026GROWI provided by GROWI, Inc.CVE-2026-41040 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpHigh 8.7
GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier.CVE-2026-26291 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user's web browser.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026GROWI OpenAI thread/message API endpoints do not perform authorization.CVE-2026-25083 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpHigh 8.7
GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant's identifier may view and/or tamper the other user's threads/messages.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier.CVE-2025-64700 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 5.1
Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025Cross-site scripting vulnerability exists in GROWI prior to v7.2.10.CVE-2025-61994 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function.CVE-2025-54806 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 5.1
GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6.CVE-2025-43880 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpMedium 5.3
Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix panic when growing a memfd_secret When one tries to grow an existing memCVE-2022-49049 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix panic when growing a memfd_secret When one tries to grow an existing memfd_secret with ftruncate, one gets a panic [1]. For example, doing the following reliably induces the panic: fd = memfd_secret(); ftruncate(fd, 10); ptr = mmap(NULL, 10, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); strcpy(ptr, "123456789"); munmap(ptr, 10); ftruncate(fd, 20); The basic reason for this is, when we grow with ftruncate, we call down into simple_setattr, and then truncate_inode_pages_range, and eventually we try to zero part of the memory. The normal truncation code does this via the direct map (i.e., it calls page_address() and hands that to memset()). For memfd_secret though, we specifically don't map our pages via the direct map (i.e. we call set_direct_map_invalid_noflush() on every fault). So the address returned by page_address() isn't useful, and when we try to memset() with it we panic. This patch avoids the panic by implementing a custom setattr for memfd_secret, which detects resizes specifically (setting the size for the first time works just fine, since there are no e
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 26, 2023Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11.CVE-2023-50339 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6.CVE-2023-50332 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user's intention.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form.CVE-2023-50294 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 6.5
The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/CVE-2023-50175 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0.CVE-2023-49807 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0.CVE-2023-49779 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0.CVE-2023-49598 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0.CVE-2023-49119 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0.CVE-2023-47215 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0.CVE-2023-46699 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3.CVE-2023-45740 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior CVE-2023-45737 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0.CVE-2023-42436 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2022Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bCVE-2022-41799 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.
- Product
- GROWI v5 series and v4 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.CVE-2022-1236 · Other software · weseek · reported by security@huntr.devMedium 6.5
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
- Product
- weseek/growi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022growi is vulnerable to Authorization Bypass Through User-Controlled KeyCVE-2021-3852 · Other software · weseek · reported by security@huntr.devHigh 7.5
growi is vulnerable to Authorization Bypass Through User-Controlled Key
- Product
- weseek/growi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2021Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary CVE-2021-20829 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via uCVE-2021-20737 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspCVE-2021-20736 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpCritical 9.1
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles.CVE-2020-14340 · Other software · Redhat · reported by Red HatMedium 5.9
A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.
- Product
- Xnio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comoracle.com
Mar 10, 2021Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject anCVE-2021-20673 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
- Product
- GROWI (v4.2 Series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 alloCVE-2021-20672 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- GROWI (v4.2 Series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the servCVE-2021-20671 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpHigh 7.2
Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the server, which may lead to arbitrary code execution.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's personal information and/CVE-2021-20670 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpHigh 7.5
Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's personal information and/or server's internal information via unspecified vectors.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a speCVE-2021-20669 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 4.7
Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a specially crafted URL.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially craftedCVE-2021-20668 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpLow 2.7
Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote autheCVE-2021-20667 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via unspecified vectorsCVE-2021-20619 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- GROWI v4.2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlieCVE-2020-5683 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpHigh 7.5
Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier allows remote attackers to alter the data by uploading a specially crafted file.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhub.docker.com
Dec 16, 2020Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI CVE-2020-5682 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpHigh 7.5
Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier allows remote attackers to cause a denial of service via unspecified vectors.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhub.docker.com
Dec 3, 2020Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.CVE-2020-5678 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhub.docker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.