CVE-2023-48197

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/grocy/grocyProduct
https://nitipoom-jar.github.io/CVE-2023-48197/Exploit, Third Party Advisory
https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48197
https://github.com/grocy/grocyProduct
https://nitipoom-jar.github.io/CVE-2023-48197/Exploit, Third Party Advisory

Timeline

Published: Nov 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-481985.4A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 all CVE-2023-481997.8HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without sc CVE-2023-48205.4The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which CVE-2023-482005.4Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via t CVE-2023-482015.4Cross Site Scripting (XSS) vulnerability in Sunlight CMS v.8.0.1, allows remote authenticated attackers to execute arbitrary code and escala CVE-2023-482025.4Cross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a craf CVE-2023-482046.5An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of t CVE-2023-482055.3Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails.CVE-2023-482066.1A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via the CVE-2023-482078.8Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component.CVE-2023-482086.1A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_a CVE-2023-48215.4The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensio