CVE-2024-55075

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes...

CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

CVE-2024-55076: Cross-Site Request Forgery (CSRF)

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

PT-2025-3094

Name of the Vulnerable Software and Affected Versions Grocy versions prior to 4.3.0 Description The issue allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes. Recommendations For Grocy versions prior to...

CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. Affected product is the Grocy web application up to version 4.3.0. Root cause and impact are stated in the CVE description; the practical consequence is CSRF vulnerability enabling unauthorized p...

CVE-2024-55075

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes...

CVE-2024-55075

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes...

CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

PT-2025-3095

Name of the Vulnerable Software and Affected Versions Grocy versions prior to 4.3.0 Description The issue is related to the lack of CSRF protection, which can be demonstrated by changing the Administrator's password. This allows unauthorized actions to be performed. Recommendations For versions...

CVE-2024-55074: Improper Neutralization of Input During Web Page Generation

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370...

CVE-2024-55075: Direct Request

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes...

Grocy security vulnerabilities

Grocy is a web-based self-hosted grocery and home management solution from Grocy Open Source. A security vulnerability exists in Grocy 4.3.0 and earlier versions, which stems from vulnerability to a stored cross-site scripting attack that can be achieved by uploading specially crafted HTML or SVG...

Grocy security vulnerabilities

Grocy is a web-based self-hosted grocery and home management solution from Grocy Open Source. A security vulnerability exists in Grocy version 4.3.0 and earlier that stems from a lack of cross-site request forgery protection...

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password...

PT-2025-3093 · Grocy · Grocy

Name of the Vulnerable Software and Affected Versions: Grocy versions prior to 4.3.0 Description: The issue in the edit profile function of Grocy allows stored Cross Site Scripting XSS and resultant privilege escalation by uploading a crafted HTML or SVG file. Recommendations: For versions prior ...