Skip to content
OpenAdvisories

Vendor

Grocy project

5 known vulnerabilities.

Products

Grocy 5
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-71236

    Grocy - Stored XSS via HTMLPurifier Output Double-Decode

    Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing <, >, and…

    Grocy project Grocy
  • High 8.1
    CVE-2024-55076

    Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.

    Grocy project Grocy
  • High 8.8
    CVE-2024-55074

    The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a cr…

    Grocy project Grocy
  • High 7.3
    CVE-2020-15253

    Stored XSS in Grocy

    Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping loca…

    Grocy project Grocy