Skip to contentGrowi, Inc. Growi vulnerabilities
- growi, inc. growiGROWI contains a missing authorization check vulnerability in its collaborative editing feature....CVE-2026-1156246.9 Medium
- growi, inc. growiGROWI contains an authorization bypass vulnerability in its tag update API and the page update...CVE-2026-1098482.3 Low
- growi, inc. growiGROWI contains an authorization bypass vulnerability in its page viewing and commenting...CVE-2026-1052722.3 Low
- growi, inc. growiAn improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker...CVE-2026-1007276.9 Medium
- growi, inc. growiGROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision RetrievalCVE-2026-842057.1 High
- growi, inc. growiGROWI through 8.0.2 Missing Authorization on apiv3 Attachment RetrievalCVE-2026-842047.1 High
- growi, inc. growiGROWI contains a vulnerability with an authorization bypass through user-controlled key in the...CVE-2026-536205.3 Medium
- growi, inc. growiGROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an...CVE-2026-689516.9 Medium
- growi, inc. growiGROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated RequestsCVE-2026-801918.7 High
- growi, inc. growiPath traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to...CVE-2026-419518.6 High
- growi, inc. growiGROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via...CVE-2026-410408.7 High
- growi, inc. growiStored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this...CVE-2026-262914.8 Medium
- growi, inc. growiGROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and...CVE-2026-250838.7 High
- growi, inc. growiCross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a...CVE-2025-647005.1 Medium
- growi, inc. growiCross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates...CVE-2025-619944.8 Medium
- growi, inc. growiGROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert...CVE-2025-548065.1 Medium
- growi, inc. growiInefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a...CVE-2025-438805.3 Medium
- growi, inc. growiStored cross-site scripting vulnerability exists in the presentation feature of GROWI versions...CVE-2023-424365.4 Medium
- growi, inc. growiImproper authorization vulnerability exists in the User Management (/admin/users) page of GROWI...CVE-2023-503326.5 Medium
- growi, inc. growiThe App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information...CVE-2023-502946.5 Medium
- growi, inc. growiStored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the...CVE-2023-501755.4 Medium
- growi, inc. growiStored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions...CVE-2023-498075.4 Medium
- growi, inc. growiStored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6...CVE-2023-497795.4 Medium
- growi, inc. growiStored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI...CVE-2023-495985.4 Medium
- growi, inc. growiStored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0...CVE-2023-491195.4 Medium
- growi, inc. growiStored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists...CVE-2023-472155.4 Medium
- growi, inc. growiCross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI...CVE-2023-466994.3 Medium
- growi, inc. growiStored cross-site scripting vulnerability when processing profile images exists in GROWI versions...CVE-2023-457405.4 Medium
- growi, inc. growiStored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the...CVE-2023-457375.4 Medium
- growi, inc. growiStored cross-site scripting vulnerability exists in the User Management (/admin/users) page of...CVE-2023-503395.4 Medium
- growi, inc. growiCross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2...CVE-2021-208296.1 Medium
- growi, inc. growiImproper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker...CVE-2021-207376.5 Medium
- growi, inc. growiNoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to...CVE-2021-207369.1 Critical
- growi, inc. growiInvalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker...CVE-2021-206717.2 High
- growi, inc. growiImproper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote...CVE-2021-206707.5 High
- growi, inc. growiPath traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with...CVE-2021-206694.7 Medium
- growi, inc. growiPath traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with...CVE-2021-206682.7 Low
- growi, inc. growiStored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy)...CVE-2021-206675.4 Medium
- growi, inc. growiDirectory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions...CVE-2020-56837.5 High
- growi, inc. growiImproper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior...CVE-2020-56827.5 High
- growi, inc. growiStored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to...CVE-2020-56786.1 Medium
- growi, inc. growiReflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers...CVE-2020-56776.1 Medium
- growi, inc. growiGROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to...CVE-2020-56767.5 High
- growi, inc. growiOpen redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users...CVE-2019-59696.1 Medium
- growi, inc. growiCross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote...CVE-2019-59688.8 High
- growi, inc. growiCross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject...CVE-2018-162055.4 Medium
- growi, inc. growiCross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject...CVE-2018-06985.4 Medium
- growi, inc. growiCross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated...CVE-2018-06554.8 Medium
- growi, inc. growiCross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to...CVE-2018-06546.1 Medium
- growi, inc. growiCross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to...CVE-2018-06536.1 Medium
- Show moreLoading…