Grocy project Grocy

• CVE-2024-55076 High 8.1 Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. 0.3%
• CVE-2024-55075 Medium 4.3 Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes. 0.5%
• CVE-2024-55074 High 8.8 The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370. 0.7%