Skip to content
OpenAdvisories

Vendor

WESEEK

40 known vulnerabilities.

WESEEK at a glance

Last 12 months
0
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

GROWI 34 GROWI (v4.2 Series) 3 weseek/growi 2 GROWI v5 series and v4 series 1
All Critical High Medium Low Exploited only Public exploit

40 results · Feed

  • Unscored —
    CVE-2023-42436

    Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this…

    WESEEK GROWI
  • Unscored —
    CVE-2023-50332

    Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.…

    WESEEK GROWI
  • Unscored —
    CVE-2023-50294

    The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As…

    WESEEK GROWI
  • Medium 5.4
    CVE-2023-50175

    Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/m…

    WESEEK GROWI
  • Unscored —
    CVE-2023-49807

    Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this…

    WESEEK GROWI
  • Unscored —
    CVE-2023-49779

    Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerabi…

    WESEEK GROWI
  • Unscored —
    CVE-2023-49598

    Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.…

    WESEEK GROWI
  • Unscored —
    CVE-2023-49119

    Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerabil…

    WESEEK GROWI
  • Unscored —
    CVE-2023-47215

    Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions pri…

    WESEEK GROWI
  • Unscored —
    CVE-2023-46699

    Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.…

    WESEEK GROWI
  • Medium 5.4
    CVE-2023-45740

    Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If t…

    WESEEK GROWI
  • Unscored —
    CVE-2023-45737

    Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admi…

    WESEEK GROWI
  • Unscored —
    CVE-2023-50339

    Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to …

    WESEEK GROWI
  • Medium 6.5
    CVE-2022-41799

    Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) al…

    WESEEK GROWI v5 series and v4 series
  • Medium 4.3
    CVE-2022-1236

    Weak Password Requirements in weseek/growi

    Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.

    WESEEK weseek/growi
  • Medium 6.3
    CVE-2021-3852

    Authorization Bypass Through User-Controlled Key in weseek/growi

    growi is vulnerable to Authorization Bypass Through User-Controlled Key

    WESEEK weseek/growi
  • Unscored —
    CVE-2021-20829

    Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows …

    WESEEK GROWI
  • Unscored —
    CVE-2021-20737

    Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthori…

    WESEEK GROWI
  • Unscored —
    CVE-2021-20736

    NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the in…

    WESEEK GROWI
  • Unscored —
    CVE-2021-20673

    Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows re…

    WESEEK GROWI (v4.2 Series)
  • Unscored —
    CVE-2021-20672

    Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Se…

    WESEEK GROWI (v4.2 Series)
  • Unscored —
    CVE-2021-20671

    Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative pri…

    WESEEK GROWI
  • Unscored —
    CVE-2021-20670

    Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to …

    WESEEK GROWI
  • Unscored —
    CVE-2021-20669

    Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read …

    WESEEK GROWI
  • Unscored —
    CVE-2021-20667

    Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versio…

    WESEEK GROWI
  • Unscored —
    CVE-2021-20668

    Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read …

    WESEEK GROWI
  • Unscored —
    CVE-2021-20619

    Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an…

    WESEEK GROWI (v4.2 Series)
  • Unscored —
    CVE-2020-5683

    Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.…

    WESEEK GROWI
  • Unscored —
    CVE-2020-5682

    Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series…

    WESEEK GROWI
  • Unscored —
    CVE-2020-5677

    Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary sc…

    WESEEK GROWI
  • Unscored —
    CVE-2020-5678

    Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary scrip…

    WESEEK GROWI
  • Unscored —
    CVE-2020-5676

    GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified ve…

    WESEEK GROWI
  • Unscored —
    CVE-2019-5969

    Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites…

    WESEEK GROWI
  • Unscored —
    CVE-2019-5968

    Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authe…

    WESEEK GROWI
  • Unscored —
    CVE-2018-0698

    Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script o…

    WESEEK GROWI
  • Unscored —
    CVE-2018-16205

    Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script o…

    WESEEK GROWI
  • Unscored —
    CVE-2018-0655

    Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitr…

    WESEEK GROWI
  • Unscored —
    CVE-2018-0653

    Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script…

    WESEEK GROWI
  • Unscored —
    CVE-2018-0654

    Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script…

    WESEEK GROWI
  • Unscored —
    CVE-2018-0652

    Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitr…

    WESEEK GROWI