Bernd Bestel

**Name of the Vulnerable Software and Affected Versions** grocy version 4.6.0 **Description** SQL injection occurs at the '/stockreports/spendings' endpoint through the `product-group` parameter. This allows attackers to access sensitive database information by using a crafted SQL statement. SQL injection is a type of flaw where an attacker can interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/stockreports/spendings' endpoint or avoid using the `product-group` parameter.