CVE-2023-45740

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WESEEK, Inc.	GROWI	prior to v4.1.3

References

https://jvn.jp/en/jp/JVN18715935/Third Party Advisory
https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/Vendor Advisory
https://jvn.jp/en/jp/JVN18715935/Third Party Advisory
https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/Vendor Advisory

Timeline

Published: Dec 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-457416.8VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute arbitrary OS commands CVE-2023-457427.2An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially c CVE-2023-457437.3Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticated user to potentially CVE-2023-457448.8A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU)CVE-2023-457458.2Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enabl CVE-2023-457465.4Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected pro CVE-2023-457474.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Syed Balkhi WP Lightbox 2 plugin <= 3.0.6.5 versions.CVE-2023-457488.8Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch plugin <= 3.1.4 versions.CVE-2023-457498.8Cross-Site Request Forgery (CSRF) vulnerability in Alexey Golubnichenko AGP Font Awesome Collection plugin <= 3.2.4 versions.CVE-2023-45756.5When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and e CVE-2023-457506.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in POSIMYTH Nexter Extension plugin <= 2.0.3 versions.CVE-2023-457517.2Improper Control of Generation of Code ('Code Injection') vulnerability in POSIMYTH Nexter Extension.This issue affects Nexter Extension: fr