Vulnerability-Lookup - Search a vulnerability

Refine your search

Product

Sort by

Order

Sources

jvndb-2026-000055

Vulnerability from jvndb

Published

2026-04-15 17:21

Modified

2026-04-15 17:21

Severity ?

5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

GROWI vulnerable to stored cross-site scripting

Details

GROWI provided by GROWI, Inc. contains the following vulnerability.<a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><ul><li>Stored cross-site scripting (CWE-79) - CVE-2026-26291</li></ul>Norihide Saito reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN62079296/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-26291
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000055.html",
  "dc:date": "2026-04-15T17:21+09:00",
  "dcterms:issued": "2026-04-15T17:21+09:00",
  "dcterms:modified": "2026-04-15T17:21+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eStored cross-site scripting (CWE-79) - CVE-2026-26291\u003c/li\u003e\u003c/ul\u003eNorihide Saito reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000055.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.4",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000055",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN62079296/index.html",
      "@id": "JVN#62079296",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-26291",
      "@id": "CVE-2026-26291",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "GROWI vulnerable to stored cross-site scripting"
}

jvndb-2026-000039

Vulnerability from jvndb

Published

2026-03-16 17:18

Modified

2026-03-16 17:18

Severity ?

8.3 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Summary

Missing authorization in the OpenAI thread/message API endpoints of GROWI

Details

GROWI provided by GROWI, Inc. contains the following vulnerability.<a href='https://cwe.mitre.org/data/definitions/862.html' target='_blank'></a><ul><li>Missing authorization in the OpenAI thread/message API endpoints (CWE-862) - CVE-2026-25083</li><li>This can be exploited only when an attacker knows a shared AI assistant's identifier</li></ul>Sho Odagiri of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to GROWI, Inc. and coordinated. After the coordination was completed, GROWI, Inc. reported the case to JPCERT/CC to notify users of the solution through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN46373837/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-25083
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000039.html",
  "dc:date": "2026-03-16T17:18+09:00",
  "dcterms:issued": "2026-03-16T17:18+09:00",
  "dcterms:modified": "2026-03-16T17:18+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/862.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eMissing authorization in the OpenAI thread/message API endpoints (CWE-862) - CVE-2026-25083\u003c/li\u003e\u003cli\u003eThis can be exploited only when an attacker knows a shared AI assistant\u0027s identifier\u003c/li\u003e\u003c/ul\u003eSho Odagiri of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to GROWI, Inc. and coordinated. After the coordination was completed, GROWI, Inc. reported the case to JPCERT/CC to notify users of the solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000039.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.3",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000039",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN46373837/index.html",
      "@id": "JVN#46373837",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-25083",
      "@id": "CVE-2026-25083",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Missing authorization in the OpenAI thread/message API endpoints of GROWI"
}

jvndb-2025-000118

Vulnerability from jvndb

Published

2025-12-17 13:04

Modified

2025-12-17 13:04

Severity ?

4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Summary

GROWI vulnerable to cross-site request forgery

Details

GROWI provided by GROWI, Inc. contains the following vulnerability.<ul><li>Cross-site request forgery (CWE-352) - CVE-2025-64700</li></ul>GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN55745775/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-64700
	Cross-Site Request Forgery(CWE-352)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000118.html",
  "dc:date": "2025-12-17T13:04+09:00",
  "dcterms:issued": "2025-12-17T13:04+09:00",
  "dcterms:modified": "2025-12-17T13:04+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\u003cul\u003e\u003cli\u003eCross-site request forgery (CWE-352) - CVE-2025-64700\u003c/li\u003e\u003c/ul\u003eGROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000118.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000118",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN55745775/index.html",
      "@id": "JVN#55745775",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-64700",
      "@id": "CVE-2025-64700",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "GROWI vulnerable to cross-site request forgery"
}

jvndb-2025-000101

Vulnerability from jvndb

Published

2025-11-06 13:45

Modified

2025-11-06 13:45

Severity ?

5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

GROWI vulnerable to stored cross-site scripting

Details

GROWI provided by GROWI, Inc. contains the following vulnerability. * Stored cross-site scripting (CWE-79) - CVE-2025-61994 Keitaro Yamazaki of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN95942191/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-61994
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000101.html",
  "dc:date": "2025-11-06T13:45+09:00",
  "dcterms:issued": "2025-11-06T13:45+09:00",
  "dcterms:modified": "2025-11-06T13:45+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\r\n\r\n* Stored cross-site scripting (CWE-79) - CVE-2025-61994\r\n\r\nKeitaro Yamazaki of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000101.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.4",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000101",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN95942191/index.html",
      "@id": "JVN#95942191",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-61994",
      "@id": "CVE-2025-61994",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "GROWI vulnerable to stored cross-site scripting"
}

jvndb-2025-000084

Vulnerability from jvndb

Published

2025-10-22 15:44

Modified

2025-10-22 15:44

Severity ?

6.1 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

GROWI vulnerable to cross-site scripting

Details

GROWI provided by GROWI, Inc. contains the following vulnerability. <ul><li>Cross-site scripting in the page alert function (CWE-79) - CVE-2025-54806</li></ul> GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN46526244/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-54806
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000084.html",
  "dc:date": "2025-10-22T15:44+09:00",
  "dcterms:issued": "2025-10-22T15:44+09:00",
  "dcterms:modified": "2025-10-22T15:44+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\r\n\u003cul\u003e\u003cli\u003eCross-site scripting in the page alert function (CWE-79) - CVE-2025-54806\u003c/li\u003e\u003c/ul\u003e\r\nGROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000084.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.1",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000084",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN46526244/index.html",
      "@id": "JVN#46526244",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-54806",
      "@id": "CVE-2025-54806",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "GROWI vulnerable to cross-site scripting"
}

jvndb-2025-000042

Vulnerability from jvndb

Published

2025-06-24 15:25

Modified

2025-06-24 15:25

Severity ?

4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Summary

Inefficient regular expressions in GROWI

Details

GROWI provided by GROWI, Inc. contains the following vulnerability. <ul><li>Inefficient regular expression complexity (CWE-1333) - CVE-2025-43880</li></ul> Takanori Okamoto of FFRI Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN21624250/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-43880
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000042.html",
  "dc:date": "2025-06-24T15:25+09:00",
  "dcterms:issued": "2025-06-24T15:25+09:00",
  "dcterms:modified": "2025-06-24T15:25+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\r\n\u003cul\u003e\u003cli\u003eInefficient regular expression complexity (CWE-1333) - CVE-2025-43880\u003c/li\u003e\u003c/ul\u003e\r\nTakanori Okamoto of FFRI Security, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000042.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000042",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN21624250/index.html",
      "@id": "JVN#21624250",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-43880",
      "@id": "CVE-2025-43880",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Inefficient regular expressions in GROWI"
}

CVE-2026-26291 (GCVE-0-2026-26291)

Vulnerability from cvelistv5

Published

2026-04-15 04:19

Modified

2026-04-15 16:13

Severity ?

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.8 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Cross-site scripting (XSS)

Summary

Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user's web browser.

References

URL

Tags

	https://growi.co.jp/news/43/
	https://jvn.jp/en/jp/JVN62079296/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v7.4.6 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-15T13:32:50.301600Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T16:13:20.770Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v7.4.6 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-15T04:19:31.678Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/43/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN62079296/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-26291",
    "datePublished": "2026-04-15T04:19:31.678Z",
    "dateReserved": "2026-04-10T06:02:38.943Z",
    "dateUpdated": "2026-04-15T16:13:20.770Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25083 (GCVE-0-2026-25083)

Vulnerability from cvelistv5

Published

2026-03-16 06:47

Modified

2026-03-16 14:59

Severity ?

8.3 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CWE

CWE-862 - Missing authorization

Summary

GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant's identifier may view and/or tamper the other user's threads/messages.

References

URL

Tags

	https://jvn.jp/en/jp/JVN46373837/
	https://growi.co.jp/news/41/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v7.4.5 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25083",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T14:59:13.916958Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-16T14:59:21.243Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v7.4.5 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant\u0027s identifier may view and/or tamper the other user\u0027s threads/messages."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing authorization",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-16T06:47:38.734Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://jvn.jp/en/jp/JVN46373837/"
        },
        {
          "url": "https://growi.co.jp/news/41/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-25083",
    "datePublished": "2026-03-16T06:47:38.734Z",
    "dateReserved": "2026-03-12T05:25:12.212Z",
    "dateUpdated": "2026-03-16T14:59:21.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64700 (GCVE-0-2025-64700)

Vulnerability from cvelistv5

Published

2025-12-17 04:06

Modified

2025-12-17 21:33

Severity ?

4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-352 - Cross-site request forgery (CSRF)

Summary

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.

References

URL

Tags

	https://growi.co.jp/news/40/
	https://jvn.jp/en/jp/JVN55745775/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v7.3.3 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64700",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T21:33:05.279502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T21:33:22.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v7.3.3 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-17T04:06:08.388Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/40/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN55745775/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-64700",
    "datePublished": "2025-12-17T04:06:08.388Z",
    "dateReserved": "2025-11-10T08:39:24.724Z",
    "dateUpdated": "2025-12-17T21:33:22.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-61994 (GCVE-0-2025-61994)

Vulnerability from cvelistv5

Published

2025-11-06 04:14

Modified

2025-11-06 14:09

Severity ?

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.8 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Cross-site scripting (XSS)

Summary

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page.

References

URL

Tags

	https://growi.co.jp/news/39/
	https://jvn.jp/en/jp/JVN95942191/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: prior to v7.2.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-61994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-06T14:09:32.236464Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-06T14:09:38.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v7.2.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-06T04:14:30.106Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/39/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN95942191/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-61994",
    "datePublished": "2025-11-06T04:14:30.106Z",
    "dateReserved": "2025-10-29T08:38:11.617Z",
    "dateUpdated": "2025-11-06T14:09:38.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-54806 (GCVE-0-2025-54806)

Vulnerability from cvelistv5

Published

2025-10-23 04:10

Modified

2025-10-23 15:05

Severity ?

6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Cross-site scripting (XSS)

Summary

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.

References

URL

Tags

	https://growi.co.jp/news/38/
	https://jvn.jp/en/jp/JVN46526244/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v4.2.7 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54806",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-23T15:04:03.231658Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-23T15:05:14.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.2.7 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability  in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-23T04:10:59.281Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/38/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN46526244/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-54806",
    "datePublished": "2025-10-23T04:10:59.281Z",
    "dateReserved": "2025-10-15T05:16:42.225Z",
    "dateUpdated": "2025-10-23T15:05:14.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-43880 (GCVE-0-2025-43880)

Vulnerability from cvelistv5

Published

2025-06-25 05:31

Modified

2025-06-25 13:35

Severity ?

4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-1333 - Inefficient regular expression complexity

Summary

Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition.

References

URL

Tags

	https://github.com/weseek/growi/pull/9487
	https://jvn.jp/en/jp/JVN21624250/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: prior to v7.1.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-43880",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-25T13:35:29.026488Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-25T13:35:33.651Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v7.1.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient regular expression complexity",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-25T05:31:29.560Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://github.com/weseek/growi/pull/9487"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN21624250/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-43880",
    "datePublished": "2025-06-25T05:31:29.560Z",
    "dateReserved": "2025-06-13T01:56:06.794Z",
    "dateUpdated": "2025-06-25T13:35:33.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Refine your search

12 vulnerabilities found for GROWI by GROWI, Inc.

jvndb-2026-000055

Vulnerability from jvndb

jvndb-2026-000039

Vulnerability from jvndb

jvndb-2025-000118

Vulnerability from jvndb

jvndb-2025-000101

Vulnerability from jvndb

jvndb-2025-000084

Vulnerability from jvndb

jvndb-2025-000042

Vulnerability from jvndb

CVE-2026-26291 (GCVE-0-2026-26291)

Vulnerability from cvelistv5

CVE-2026-25083 (GCVE-0-2026-25083)

Vulnerability from cvelistv5

CVE-2025-64700 (GCVE-0-2025-64700)

Vulnerability from cvelistv5

CVE-2025-61994 (GCVE-0-2025-61994)

Vulnerability from cvelistv5

CVE-2025-54806 (GCVE-0-2025-54806)

Vulnerability from cvelistv5

CVE-2025-43880 (GCVE-0-2025-43880)

Vulnerability from cvelistv5