Grocy@* Security Vulnerabilities and Issues — Grocy@* CVE List

Lucene search

Grocy ProjectGrocy*

5 matches found

CVE•added 2025/01/06 8:15 p.m.•36 views

CVE-2024-55074

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.

8.8CVSS6.2AI score0.00063EPSS

CVE•added 2025/01/06 9:15 p.m.•34 views

CVE-2024-55076

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.

8.1CVSS7.1AI score0.00012EPSS

CVE•added 2025/01/06 9:15 p.m.•33 views

CVE-2024-55075

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes.

4.3CVSS4.6AI score0.00017EPSS

CVE•added 2023/12/04 3:15 p.m.•30 views

CVE-2023-48866

A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy

5.4CVSS5.2AI score0.00223EPSS

CVE•added 2023/09/15 2:15 p.m.•28 views

CVE-2023-42270

Grocy

8.8CVSS8.7AI score0.00159EPSS