# cve.now: Weseek, Inc.

The newest entries naming Weseek, Inc. as an affected vendor (up to 200), of 40 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2023-42436](https://cve.now/CVE-2023-42436.md): Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. (no CVSS)
- [CVE-2023-50332](https://cve.now/CVE-2023-50332.md): Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. (no CVSS)
- [CVE-2023-50294](https://cve.now/CVE-2023-50294.md): The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. (no CVSS)
- [CVE-2023-50175](https://cve.now/CVE-2023-50175.md): Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and th (CVSS 5.4)
- [CVE-2023-49807](https://cve.now/CVE-2023-49807.md): Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. (no CVSS)
- [CVE-2023-49779](https://cve.now/CVE-2023-49779.md): Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. (no CVSS)
- [CVE-2023-49598](https://cve.now/CVE-2023-49598.md): Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. (no CVSS)
- [CVE-2023-49119](https://cve.now/CVE-2023-49119.md): Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. (no CVSS)
- [CVE-2023-47215](https://cve.now/CVE-2023-47215.md): Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. (no CVSS)
- [CVE-2023-46699](https://cve.now/CVE-2023-46699.md): Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. (no CVSS)
- [CVE-2023-45740](https://cve.now/CVE-2023-45740.md): Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. (CVSS 5.4)
- [CVE-2023-45737](https://cve.now/CVE-2023-45737.md): Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of G (no CVSS)
- [CVE-2023-50339](https://cve.now/CVE-2023-50339.md): Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. (no CVSS)
- [CVE-2022-41799](https://cve.now/CVE-2022-41799.md): Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authent (CVSS 6.5)
- [CVE-2022-1236](https://cve.now/CVE-2022-1236.md): Weak Password Requirements in weseek/growi (CVSS 4.3)
- [CVE-2021-3852](https://cve.now/CVE-2021-3852.md): Authorization Bypass Through User-Controlled Key in weseek/growi (CVSS 6.3)
- [CVE-2021-20829](https://cve.now/CVE-2021-20829.md): Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to e (no CVSS)
- [CVE-2021-20737](https://cve.now/CVE-2021-20737.md): Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without acc (no CVSS)
- [CVE-2021-20736](https://cve.now/CVE-2021-20736.md): NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in t (no CVSS)
- [CVE-2021-20673](https://cve.now/CVE-2021-20673.md): Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated at (no CVSS)
- [CVE-2021-20672](https://cve.now/CVE-2021-20672.md): Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v (no CVSS)
- [CVE-2021-20671](https://cve.now/CVE-2021-20671.md): Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite t (no CVSS)
- [CVE-2021-20670](https://cve.now/CVE-2021-20670.md): Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's perso (no CVSS)
- [CVE-2021-20669](https://cve.now/CVE-2021-20669.md): Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbi (no CVSS)
- [CVE-2021-20668](https://cve.now/CVE-2021-20668.md): Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via (no CVSS)
- [CVE-2021-20667](https://cve.now/CVE-2021-20667.md): Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier (no CVSS)
- [CVE-2021-20619](https://cve.now/CVE-2021-20619.md): Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via (no CVSS)
- [CVE-2020-5683](https://cve.now/CVE-2020-5683.md): Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI (no CVSS)
- [CVE-2020-5682](https://cve.now/CVE-2020-5682.md): Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 serie (no CVSS)
- [CVE-2020-5678](https://cve.now/CVE-2020-5678.md): Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vec (no CVSS)
- [CVE-2020-5677](https://cve.now/CVE-2020-5677.md): Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified (no CVSS)
- [CVE-2020-5676](https://cve.now/CVE-2020-5676.md): GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors. (no CVSS)
- [CVE-2019-5969](https://cve.now/CVE-2019-5969.md): Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites and conduct phishing (no CVSS)
- [CVE-2019-5968](https://cve.now/CVE-2019-5968.md): Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authentication of administ (no CVSS)
- [CVE-2018-16205](https://cve.now/CVE-2018-16205.md): Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page m (no CVSS)
- [CVE-2018-0698](https://cve.now/CVE-2018-0698.md): Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecifie (no CVSS)
- [CVE-2018-0655](https://cve.now/CVE-2018-0655.md): Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2018-0654](https://cve.now/CVE-2018-0654.md): Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the moda (no CVSS)
- [CVE-2018-0653](https://cve.now/CVE-2018-0653.md): Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki pag (no CVSS)
- [CVE-2018-0652](https://cve.now/CVE-2018-0652.md): Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTM (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/weseek
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.