Grocy Project

Grocy

11 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.1

CVE-2024-55076

Exploit
  • EPSS 0.12%
  • Veröffentlicht 06.01.2025 21:15:15
  • Zuletzt bearbeitet 05.09.2025 14:07:09

Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.

5.3

CVE-2024-55075

Exploit
  • EPSS 0.07%
  • Veröffentlicht 06.01.2025 21:15:14
  • Zuletzt bearbeitet 29.09.2025 17:47:24

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes.

9

CVE-2024-55074

Exploit
  • EPSS 0.12%
  • Veröffentlicht 06.01.2025 20:15:39
  • Zuletzt bearbeitet 05.09.2025 00:23:07

The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.

5.4

CVE-2024-8370

Exploit
  • EPSS 0.2%
  • Veröffentlicht 01.09.2024 22:15:14
  • Zuletzt bearbeitet 29.09.2025 13:59:14

A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument force_serve_as with th...

5.4

CVE-2023-48866

  • EPSS 0.44%
  • Veröffentlicht 04.12.2023 15:15:07
  • Zuletzt bearbeitet 29.09.2025 15:16:04

A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies.

7.8

CVE-2023-48199

Exploit
  • EPSS 0.91%
  • Veröffentlicht 15.11.2023 23:15:09
  • Zuletzt bearbeitet 29.09.2025 15:16:03

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of ...

5.4

CVE-2023-48200

Exploit
  • EPSS 0.32%
  • Veröffentlicht 15.11.2023 23:15:09
  • Zuletzt bearbeitet 29.09.2025 15:16:04

Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment description component within /equipment/ component.

5.4

CVE-2023-48197

Exploit
  • EPSS 0.45%
  • Veröffentlicht 15.11.2023 23:15:08
  • Zuletzt bearbeitet 29.09.2025 14:16:42

Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function.

5.4

CVE-2023-48198

Exploit
  • EPSS 0.56%
  • Veröffentlicht 15.11.2023 23:15:08
  • Zuletzt bearbeitet 29.09.2025 14:16:42

A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to obtain a victim's cookies.

8.8

CVE-2023-42270

Exploit
  • EPSS 0.21%
  • Veröffentlicht 15.09.2023 14:15:11
  • Zuletzt bearbeitet 21.11.2024 08:22:23

Grocy <= 4.0.2 is vulnerable to Cross Site Request Forgery (CSRF).