https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-55076.htmlhttps://patchthecve.com/cve/CVE-2024-55076.htmlWed, 17 Jun 2026 08:10:57 +0000HIGH 8.1: Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.https://patchthecve.com/cve/CVE-2024-55075.htmlhttps://patchthecve.com/cve/CVE-2024-55075.htmlWed, 17 Jun 2026 08:10:57 +0000MEDIUM 4.3: Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes.https://patchthecve.com/cve/CVE-2024-55074.htmlhttps://patchthecve.com/cve/CVE-2024-55074.htmlWed, 17 Jun 2026 08:10:57 +0000HIGH 8.8: The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.https://patchthecve.com/cve/CVE-2024-8370.htmlhttps://patchthecve.com/cve/CVE-2024-8370.htmlWed, 17 Jun 2026 08:22:27 +0000LOW 3.5: A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument force_serve_as with the input picture' leads to cross site scripting. Thhttps://patchthecve.com/cve/CVE-2023-48866.htmlhttps://patchthecve.com/cve/CVE-2023-48866.htmlWed, 17 Jun 2026 06:35:06 +0000MEDIUM 5.4: A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies.https://patchthecve.com/cve/CVE-2023-48200.htmlhttps://patchthecve.com/cve/CVE-2023-48200.htmlWed, 17 Jun 2026 06:33:44 +0000MEDIUM 5.4: Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment description component within /equipment/ component.https://patchthecve.com/cve/CVE-2023-48199.htmlhttps://patchthecve.com/cve/CVE-2023-48199.htmlWed, 17 Jun 2026 06:33:44 +0000HIGH 7.8: HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker chttps://patchthecve.com/cve/CVE-2023-48198.htmlhttps://patchthecve.com/cve/CVE-2023-48198.htmlWed, 17 Jun 2026 06:33:44 +0000MEDIUM 5.4: A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to obtain a victim's cookies.https://patchthecve.com/cve/CVE-2023-48197.htmlhttps://patchthecve.com/cve/CVE-2023-48197.htmlWed, 17 Jun 2026 06:33:43 +0000MEDIUM 5.4: Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function.