Beschreibung
Grocy-s API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing <, >, and & back to <, >, and & immediately after purification.
CVSS 8.7EPSS 0.199%Risiko 0.89
Quelle öffnen- Veröffentlicht
- 2026-08-05 11:16:26
- Zuletzt geändert
- 2026-08-10 12:17:26
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N