Grocy 跨站脚本漏洞

Grocy is a web-based self-hosted grocery and home management solution from Grocy Open Source. A cross-site scripting vulnerability exists in Grocy 4.2.0 and earlier versions, which stems from the parameter forceserveas in the file /api/files/recipepictures/ can lead to cross-site scripting attack...

CVE-2024-8370: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument forceserveas with the input picture' leads to cross site scripting. T...