{"id":"CVE-2025-64700","title":"Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier","summary":"Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-352"],"published":"2025-12-17","updated":"2026-10-13","sourceUpdated":"2026-10-13T11:10:00.203","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-64700","references":[{"url":"https://growi.co.jp/news/40/","label":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/jp/JVN55745775/","label":"vultures@jpcert.or.jp"}],"tags":["nvd"],"epss":0.00125,"epssPercentile":0.01944,"ingestedAt":"2026-10-13T11:23:51.115Z","slug":"CVE-2025-64700","body":"## Overview\n\nCross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}