{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-07T17:49:25.815","vulnerabilities":[{"cve":{"id":"CVE-2020-15253","sourceIdentifier":"security-advisories@github.com","published":"2020-10-14T19:15:13.853","lastModified":"2024-11-21T05:05:12.023","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept."},{"lang":"es","value":"Las versiones de Grocy anteriores a 2.7.1 incluyéndola, son vulnerables a un ataque de tipo Cross Site Scripting por medio del módulo Create Shopping List, que es procesado al eliminar esa Lista de Compras.&#xa0;El problema también fue encontrado en usuarios, baterías, quehaceres, equipos, ubicaciones, unidades de cantidad, ubicaciones de compras, tareas, categorías de tareas, grupos de productos, recetas y productos.&#xa0;Es requerida una autenticación para explotar estos problemas y Grocy no debería ser expuesto públicamente.&#xa0;La referencia vinculada detalla una prueba de concepto"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grocy:grocy:*:*:*:*:*:*:*:*","versionEndIncluding":"2.7.1","matchCriteriaId":"8A2346AA-2AF0-4B7B-9142-F2F30F79DD26"}]}]}],"references":[{"url":"https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grocy/grocy/issues/996","source":"security-advisories@github.com","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/48792","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grocy/grocy/issues/996","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/48792","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]}]}}]}