Grocy Project vulnerabilities
We track 2 vulnerabilities in Grocy Project products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on January 6, 2025.
2vulnerabilities
1critical
1high
0exploited
8.4average CVSS score
Latest Grocy Project vulnerabilities
- 9.0 Critical severity
Grocy: Improper Neutralization of Input During Web Page Generation
The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.
- 7.8 High severity
Grocy: Improper Neutralization of Special Elements in Output Used by a Downstream Component
HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags