Read the docs

grocy

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

grocy records in CISA KEV

No grocy vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Grocy 1 record LOW

Records

2 records

TI-2026-49907 CVE-2026-71236 · GHSA-c924-wcfj-cr8j

Grocy - Stored XSS via HTMLPurifier Output Double-Decode

Priority MEDIUM 40

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting outp…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00353 Published 2026-08-05 No fix listed CWE-79
TI-2020-12025 CVE-2020-15253

Stored XSS in Grocy

Priority LOW 35

Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List.

CVSS 3.1HIGH 7.3 Network High privileges User interaction EPSS 0.01247 Published 2020-10-14 No fix listed CWE-79
Open these records in search →