CVE-2024-22075
Published Jan 5, 2024Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.
Vendor/product archive
firefly-iii / firefly_iii CVEs
Beta · best-effort26 CVEs tagged to firefly-iii / firefly_iii — 2 Critical, 4 High, 19 Medium, 1 Low, 0 Unrated.
CVE-2023-1788
Published Apr 5, 2023Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
CVE-2023-1789
Published Apr 1, 2023Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
CVE-2023-0298
Published Jan 14, 2023Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
CVE-2021-4005
Published Dec 4, 2021firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-4015
Published Dec 1, 2021firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3921
Published Nov 13, 2021firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3901
Published Oct 27, 2021firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3900
Published Oct 27, 2021firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3851
Published Oct 19, 2021firefly-iii is vulnerable to URL Redirection to Untrusted Site
CVE-2021-3846
Published Oct 19, 2021firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
CVE-2021-3819
Published Sep 27, 2021firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3730
Published Aug 23, 2021firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3729
Published Aug 23, 2021firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3728
Published Aug 23, 2021firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-3663
Published Jul 25, 2021firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
CVE-2019-14672
Published Aug 5, 2019Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error con…
CVE-2019-14671
Published Aug 5, 2019Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. Thi…
CVE-2019-14670
Published Aug 5, 2019Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill…
CVE-2019-14669
Published Aug 5, 2019Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to t…
CVE-2019-14668
Published Aug 5, 2019Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during d…
CVE-2019-14667
Published Aug 5, 2019Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account nam…
CVE-2019-13647
Published Jul 18, 2019Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/v…
CVE-2019-13646
Published Jul 18, 2019Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the s…
CVE-2019-13645
Published Jul 18, 2019Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edi…
Showing 1-25 of 26 CVEsPage 1 of 2