Grocy vulnerabilities
We track 1 vulnerability in Grocy products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
1vulnerabilities
0critical
1high
0exploited
8.7average CVSS score
Latest Grocy vulnerabilities
- 8.7 High severity
grocy: Improper Neutralization of Input During Web Page Generation
Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing <, >, and