Skip to content

Vendor

grocy vulnerabilities

2 published CVES affecting grocy, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of grocy alerts

Products

Latest grocy CVEs

Newest publication first

  1. CVE-2026-71236 Grocy - Stored XSS via HTMLPurifier Output Double-Decode

    Published
    HighCVSS 8.7 EPSS 0.35%

    Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & im...

  2. CVE-2020-15253 Stored XSS in Grocy

    Published
    MediumCVSS 4.8 EPSS 1.2%

    Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcat...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.