Products: 1
Vulnerabilities: 11
Known Exploited: 0
0
Critical Level Threats
4
High Level Threats
6
Medium Level Threats
1
Low Level Threats
Vulnerabilities
100806040200
JanFebMarAprMayJunJulAugSepOctNovDec
Critical Level Threats
High Level Threats
Medium Level Threats
Low Level Threats
Products Security index
Actions
Items Per Page
Vulnerabilities
CVE-2024-55075
Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes.
Last Modified: Sep 29, 2025
Published: Jan 06, 2025
CVE-2024-55074
The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.
Last Modified: Sep 05, 2025
Published: Jan 06, 2025
CVE-2024-55076
Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.
Last Modified: Sep 05, 2025
Published: Jan 06, 2025
CVE-2024-8370
Grocy SVG File Upload recipepictures cross site scripting
Last Modified: Sep 29, 2025
Published: Sep 01, 2024
CVE-2023-48866
A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies.
Last Modified: Sep 29, 2025
Published: Dec 04, 2023
Items Per Page
