CVE-2024-8370

A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument force_serve_as with the input picture' leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. Unfortunately, the project maintainer does not want to be quoted in any way regarding the dispute rationale. The security policy of the project implies that this finding is "practically irrelevant" due to authentication requirements.

• CWE-79

• https://vuldb.com/?ctiid.276274Permissions Required, VDB Entry
• https://vuldb.com/?id.276274Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.400844Exploit, Third Party Advisory, VDB Entry

Published

Sep 1, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8364The WP Custom Fields Search plugin for WordPress is vulnerab…5.4
• CVE-2024-8365Vault Community Edition and Vault Enterprise experienced a r…6.5
• CVE-2024-8366A vulnerability was found in code-projects Pharmacy Manageme…4.7
• CVE-2024-8367A vulnerability was found in HM Courts & Tribunals Service P…5.1
• CVE-2024-8368A vulnerability was found in code-projects Hospital Manageme…9.8
• CVE-2024-8369The EventPrime – Events Calendar, Bookings and Tickets plugi…5.3
• CVE-2024-8371Rejected reason: Duplicate of CVE-2024-45305.
• CVE-2024-8372Improper sanitization of the value of the 'srcset' attribute…4.3
• CVE-2024-8373Improper sanitization of the value of the [srcset] attribute…4.3
• CVE-2024-8374UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 ar…7.8
• CVE-2024-8375There exists a use after free vulnerability in Reverb. Rever…7.8
• CVE-2024-8376In Eclipse Mosquitto up to version 2.0.18a, an attacker can …7.5