Skip to content
OpenAdvisories
Medium · 5.4 CVE-2023-50175 EUVD-2023-54997GHSA-g845-grc9-p9qg

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and t…

Published Dec 26, 2023 · Updated Apr 23, 2025 · Assigned by jpcert

Description

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Affected products

VendorProductAffectedFixed
WESEEK GROWI prior to v6.0.0 —

References