CVE-2023-48197

5.4 mediumEPSS 0.7%

Medium (5.4) in grocy project grocy. EPSS 0.7% chance of exploitation in the next 30 days.

Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2023-11-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

grocy_project:grocy

References

https://github.com/grocy/grocy
https://nitipoom-jar.github.io/CVE-2023-48197/
https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48197
https://github.com/grocy/grocy
https://nitipoom-jar.github.io/CVE-2023-48197/

Check your stack JSON