CVE-2018-0652

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page.

• CWE-79

• http://jvn.jp/en/jp/JVN18716340/index.htmlThird Party Advisory, VDB Entry
• https://weseek.co.jp/security/2018/07/31/growi-prevent-xss/Vendor Advisory
• http://jvn.jp/en/jp/JVN18716340/index.htmlThird Party Advisory, VDB Entry
• https://weseek.co.jp/security/2018/07/31/growi-prevent-xss/Vendor Advisory

Published

Sep 7, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0646Directory traversal vulnerability in Explzh v.7.58 and earli…
• CVE-2018-0647Cross-site request forgery (CSRF) vulnerability in WL-330NUL…
• CVE-2018-0648Untrusted search path vulnerability in installer of ChatWork…
• CVE-2018-0649Untrusted search path vulnerability in the installers of mul…
• CVE-2018-0650The LINE MUSIC for Android version 3.1.0 to versions prior t…
• CVE-2018-0651Buffer overflow in the license management function of YOKOGA…
• CVE-2018-0653Cross-site scripting vulnerability in GROWI v.3.1.11 and ear…
• CVE-2018-0654Cross-site scripting vulnerability in GROWI v.3.1.11 and ear…
• CVE-2018-0655Cross-site scripting vulnerability in GROWI v.3.1.11 and ear…
• CVE-2018-0656Untrusted search path vulnerability in The installer of Digi…
• CVE-2018-0657Cross-site scripting vulnerability in EC-CUBE Payment Module…
• CVE-2018-0658Input validation issue in EC-CUBE Payment Module (2.12) vers…