CVE-2020-15253 | BDVDB-2026-142913 Detail
grocygrocy
Description#
Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References#
- https://www.exploit-db.com/exploits/48792
- https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7
- https://github.com/grocy/grocy/issues/996
- https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772
- https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.