CVE-2023-48199

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution

published November 15, 2023

CVSS
—
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker can then manipulate page content in the QR code detail popup, often coupled with social engineering tactics, exploiting both the trust of users and the application's lack of proper input handling.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00502 · 42.1th percentile
Published
2023-11-15T00:00Z
EPSS history
Timeline
  • 15 NOV 00:00Z
    HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution
    cvelistv5