Grocy vulnerabilities

2 known vulnerabilities in Grocy from Grocy Project. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  Grocy: Improper Neutralization of Input During Web Page Generation

  CVE-2024-55074Jan 6, 2025Grocy Project

  The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.

• 7.8 High severity

  Grocy: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2023-48199Nov 15, 2023Grocy Project

  HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags