CVE-2020-15253

MEDIUM 4.8CVE-2020-15253 · Published 14/10/2020 · updated 17/06/2026

In short

CVE-2020-15253 is a MEDIUM (CVSS 4.8) vulnerability affecting grocy (grocy).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 69.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
grocy grocy	`≤ 2.7.1`	No fix yet

Description

Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.

References

grocy/grocy commit 0624b0d · Patch
grocy/grocy commit 0df2590 · Patch
grocy/grocy · Exploit
grocy/grocy security advisory · Third Party Advisory
exploit-db.com/exploits/48792 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free