EUVD-2026-162718

fkie_cve-2023-46699

Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention.

GHSA-5q4h-2vw3-5vc3

jvndb-2023-000123

GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. <ul><li>Stored cross-site scripting vulnerability in the presentation feature (CWE-79) - CVE-2023-42436</li><li>Stored cross-site scripting vulnerability in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page (CWE-79) - CVE-2023-45737</li><li>Stored cross-site scripting vulnerability when processing profile images (CWE-79) - CVE-2023-45740</li><li>Cross-site request forgery vulnerability in the User settings (/me) page (CWE-352) - CVE-2023-46699</li><li>Stored cross-site scripting vulnerability exploiting a behavior of the XSS Filter (CWE-79) - CVE-2023-47215</li><li>Stored cross-site scripting vulnerability via the img tags (CWE-79) - CVE-2023-49119</li><li>Stored cross-site scripting vulnerability in the event handlers of the pre tags (CWE-79) - CVE-2023-49598</li><li>Stored cross-site scripting vulnerability in the anchor tag (CWE-79) - CVE-2023-49779</li><li>Stored cross-site scripting vulnerability when processing the MathJax (CWE-79) - CVE-2023-49807</li><li>Stored cross-site scripting vulnerability in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page (CWE-79) - CVE-2023-50175</li><li>Cleartext storage of sensitive information vulnerability in the App Settings (/admin/app) page's Secret access key (CWE-312) - CVE-2023-50294</li><li>Improper authorization in the User Management (/admin/u…

Most recent entries from all

EUVD-2026-162718

fkie_cve-2023-46699

GHSA-5q4h-2vw3-5vc3

gsd-2023-46699

jvndb-2023-000123