CVE-2023-48200VulnerabilityPublished 15 Nov 2023Updated 29 Sep 2025

CVE-2023-48200: n/a

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 06:26 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Nov 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Organizations should immediately review and restrict access to Grocy instances to trusted users only, minimizing the risk of local attackers exploiting this vulnerability. Implement strict input validation and output encoding on the equipment description field to sanitize any user-supplied data, preventing script injection. If possible, upgrade to a patched version of Grocy once available or apply community patches addressing this issue. Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts within the application context. Conduct regular security audits and penetration testing focusing on web application vulnerabilities, particularly XSS. Educate users about the risks of clicking on suspicious links or executing unknown scripts within the application. Additionally, monitor logs for unusual activity that could indicate exploitation attempts. Network segmentation can also limit the spread of an attack originating from this vulnerability. Finally, maintain backups of critical data to ensure recovery in case of compromise.

Description

Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment description component within /equipment/ component.

Impact

For European organizations using Grocy, especially those deploying it internally for inventory or equipment management, this vulnerability poses a risk to confidentiality and integrity of data. If exploited, attackers could steal session cookies or credentials, leading to unauthorized access to the application and potentially other connected systems. This could result in data leakage of sensitive inventory or operational information. Additionally, the execution of arbitrary code in users' browsers could facilitate further attacks such as phishing or lateral movement within the network. Since Grocy is often used by small to medium enterprises, including in sectors like retail, hospitality, and facility management, exploitation could disrupt business operations and damage trust. The local access requirement somewhat limits the attack surface, but insider threats or compromised internal accounts could still leverage this vulnerability. The absence of known exploits suggests the threat is not yet widespread, but organizations should act proactively to prevent exploitation. The impact on availability is limited, as XSS typically does not cause system downtime but can degrade user trust and data integrity.

References

Community reviews

Loading reviews…