Grocy Project Grocy
11 CVEs affecting Grocy Project Grocy. Latest disclosed: 2025-01-06. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55074 | High | 8.8 | 2025-01-06 | The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issu… |
CVE-2023-42270 | High | 8.8 | 2023-09-15 | Grocy <= 4.0.2 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2024-55076 | High | 8.1 | 2025-01-06 | Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. |
CVE-2023-48199 | High | 7.8 | 2023-11-15 | HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. Thi… |
CVE-2023-48866 | Medium | 5.4 | 2023-12-04 | A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_list… |
CVE-2023-48200 | Medium | 5.4 | 2023-11-15 | Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment descri… |
CVE-2023-48198 | Medium | 5.4 | 2023-11-15 | A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to ob… |
CVE-2023-48197 | Medium | 5.4 | 2023-11-15 | Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victi… |
CVE-2020-25454 | Medium | 5.4 | 2020-11-18 | Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe. |
CVE-2024-55075 | Medium | 4.3 | 2025-01-06 | Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and rec… |
CVE-2024-8370 | Low | 3.5 | 2024-09-01 | A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the… |