{"api_version":"1","generated_at":"2026-07-23T11:19:37+00:00","cve":"CVE-2020-15253","urls":{"html":"https://cve.report/CVE-2020-15253","api":"https://cve.report/api/cve/CVE-2020-15253.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-15253","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-15253"},"summary":{"title":"CVE-2020-15253","description":"Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2020-10-14 19:15:00","updated_at":"2022-10-18 20:20:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7","name":"https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"XSS and HTML injection possible at some places · Advisory · grocy/grocy · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/48792","name":"https://www.exploit-db.com/exploits/48792","refsource":"MISC","tags":[],"title":"grocy 2.7.1 - Persistent Cross-Site Scripting - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/grocy/grocy/issues/996","name":"https://github.com/grocy/grocy/issues/996","refsource":"MISC","tags":["Exploit","Issue Tracking","Third Party Advisory"],"title":"XSS and HTML Injection on Create Shopping List & shopping list item notes (Rendered upon deleting it) · Issue #996 · grocy/grocy · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887","name":"https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Excape HTML (where needed, for bootbox) (references #996) · grocy/grocy@0df2590 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772","name":"https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Excape shopping list item notes (references #996) · grocy/grocy@0624b0d · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15253","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15253","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"15253","vulnerable":"1","versionEndIncluding":"2.7.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"grocy","cpe5":"grocy","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2020-15253","STATE":"PUBLIC","TITLE":"Stored XSS in Grocy"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"grocy","version":{"version_data":[{"version_value":"<= 2.7.1"}]}}]},"vendor_name":"grocy"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept."}]},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"{\"CWE-79\":\"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\"}"}]}]},"references":{"reference_data":[{"name":"https://www.exploit-db.com/exploits/48792","refsource":"MISC","url":"https://www.exploit-db.com/exploits/48792"},{"name":"https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7","refsource":"CONFIRM","url":"https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7"},{"name":"https://github.com/grocy/grocy/issues/996","refsource":"MISC","url":"https://github.com/grocy/grocy/issues/996"},{"name":"https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772","refsource":"MISC","url":"https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772"},{"name":"https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887","refsource":"MISC","url":"https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887"}]},"source":{"advisory":"GHSA-7f37-2fjr-v9p7","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2020-10-14 19:15:00","lastModifiedDate":"2022-10-18 20:20:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.7,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.5},"severity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:grocy:grocy:*:*:*:*:*:*:*:*","versionEndIncluding":"2.7.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"15253","Ordinal":"176632","Title":"CVE-2020-15253","CVE":"CVE-2020-15253","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"15253","Ordinal":"1","NoteData":"Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"15253","Ordinal":"2","NoteData":"2020-10-14","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"15253","Ordinal":"3","NoteData":"2020-11-15","Type":"Other","Title":"Modified"}]}}}