CVE-2020-15253highCWE-79

CVE-2020-15253: falha de alta gravidade em grocy

Stored XSS in Grocy

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Grocy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 1.2%
Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
grocy · grocy
CVEs relacionadas — grocy

No mesmo produto, das mais perigosas para as menos.

CVE-2026-71236HIGHGrocy - Stored XSS via HTMLPurifier Output Double-DecodeEPSS 0.4%