Grocy Project Grocy
3 CVEs affecting Grocy Project Grocy. Latest disclosed: 2025-01-06. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55074 | High | 8.8 | 2025-01-06 | The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issu… |
CVE-2024-55076 | High | 8.1 | 2025-01-06 | Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. |
CVE-2024-55075 | Medium | 4.3 | 2025-01-06 | Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and rec… |