CVE-2025-54806: Weseek Growi

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.

Affected products

• Weseek Growi: before 4.2.8 (fixed in 4.2.8)

Published 2025-10-23. Last modified 2026-06-17.