CVE-2020-15253

Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.

• CWE-79

• https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772Patch, Third Party Advisory
• https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887Patch, Third Party Advisory
• https://github.com/grocy/grocy/issues/996Exploit, Issue Tracking, Third Party Advisory
• https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7Third Party Advisory
• https://www.exploit-db.com/exploits/48792Exploit, Third Party Advisory, VDB Entry
• https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772Patch, Third Party Advisory
• https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887Patch, Third Party Advisory
• https://github.com/grocy/grocy/issues/996Exploit, Issue Tracking, Third Party Advisory
• https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7Third Party Advisory
• https://www.exploit-db.com/exploits/48792Exploit, Third Party Advisory, VDB Entry

Published

Oct 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15248October is a free, open-source, self-hosted CMS platform bas…4.2
• CVE-2020-15249October is a free, open-source, self-hosted CMS platform bas…5.4
• CVE-2020-1525A memory corruption vulnerability exists when Windows Media …7.8
• CVE-2020-15250In JUnit4 from version 4.7 and before 4.13.1, the test rule …5.5
• CVE-2020-15251In the Channelmgnt plug-in for Sopel (a Python IRC bot) befo…6.5
• CVE-2020-15252In XWiki before version 12.5 and 11.10.6, any user with SCRI…8.8
• CVE-2020-15254Crossbeam is a set of tools for concurrent programming. In c…9.8
• CVE-2020-15255In Anuko Time Tracker before verion 1.19.23.5325, due to not…7.3
• CVE-2020-15256A prototype pollution vulnerability has been found in `objec…9.8
• CVE-2020-15257containerd is an industry-standard container runtime and is …5.2
• CVE-2020-15258In Wire before 3.20.x, `shell.openExternal` was used without…8
• CVE-2020-15259ad-ldap-connector's admin panel before version 5.0.13 does n…8.8