Skip to content
OpenAdvisories
Medium · 5.4 CVE-2025-61994 EUVD-2025-37975GHSA-rrj6-v2g6-p956

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arb…

Published Nov 6, 2025 · Updated Nov 6, 2025 · Assigned by jpcert

Description

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page.

Affected products

VendorProductAffectedFixed
GROWI GROWI prior to v7.2.10 —

References