Grocy is a self-hosted personal grocery and household management application with a narrow, focused vulnerability footprint concentrated in a single product. The observed weakness class centers on cross-site scripting in web-page generation, a characteristic input-handling gap in web applications. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Grocy over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-55074CRITICAL The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370. | Jan 6, 2025 | 9.0 | 24 | NO | NO |
CVE-2023-42270HIGH Grocy <= 4.0.2 is vulnerable to Cross Site Request Forgery (CSRF). | Sep 15, 2023 | 8.8 | 24 | NO | NO |
CVE-2023-48199HIGH HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-su | Nov 15, 2023 | 7.8 | 23 | NO | NO |
CVE-2024-55076HIGH Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. | Jan 6, 2025 | 8.1 | 22 | NO | NO |
CVE-2024-8370MEDIUM A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File U | Sep 1, 2024 | 5.4 | 19 | NO | NO |
CVE-2023-48198MEDIUM A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to obtain a victim's cooki | Nov 15, 2023 | 5.4 | 19 | NO | NO |
CVE-2023-48197MEDIUM Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see | Nov 15, 2023 | 5.4 | 19 | NO | NO |
CVE-2020-25454MEDIUM Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe. | Nov 18, 2020 | 5.4 | 18 | NO | NO |
CVE-2024-55075MEDIUM Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes. | Jan 6, 2025 | 5.3 | 17 | NO | NO |
CVE-2023-48866MEDIUM A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 | Dec 4, 2023 | 5.4 | 17 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Grocy.
Media articles that mention a CVE ID that affects a product developed by Grocy — matched by CVE ID, not by vendor name.