TI-2023-01681 CVE-2023-1789 · GHSA-mwxw-hxvp-4r2r
Improper Input Validation in firefly-iii/firefly-iii
Priority HIGH 75
Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
firefly-iii
Records28All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
firefly-iii records in CISA KEVNo firefly-iii vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
28 records
TI-2023-01680 CVE-2023-1788 · GHSA-h7vv-46p5-prmh
Insufficient Session Expiration in firefly-iii/firefly-iii
Priority HIGH 75
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
TI-2023-00283 CVE-2023-0298 · GHSA-7mc4-jp4f-v2j2
Incorrect Authorization in firefly-iii/firefly-iii
Priority MEDIUM 62
Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
TI-2019-10251 CVE-2019-13644 · GHSA-9xmx-rj7j-fv9q
Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of…
Priority MEDIUM 58
Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name.
TI-2021-02811 CVE-2021-3901 · GHSA-rqgp-ccph-5w65
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
Priority LOW 39
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
TI-2021-02777 CVE-2021-3846 · GHSA-5gq7-826w-8282
Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii
Priority LOW 39
firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
TI-2021-02750 CVE-2021-3819 · GHSA-356r-77q8-f64f
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
Priority LOW 39
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
TI-2021-02605 CVE-2021-3663 · GHSA-56cx-wf47-hx7w
Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii
Priority LOW 34
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
TI-2021-02810 CVE-2021-3900 · GHSA-pfj7-w373-gqch
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
Priority LOW 30
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
TI-2019-10895 CVE-2019-14667 · GHSA-cc63-hf4q-596r
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of…
Priority LOW 30
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name.
TI-2021-02663 CVE-2021-3730 · GHSA-c676-mcw3-qg55
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
Priority LOW 29
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
TI-2021-02661 CVE-2021-3728 · GHSA-xp5q-77mh-6hm2
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
Priority LOW 29
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
TI-2024-25209 CVE-2024-37893 · GHSA-4gm4-c4mh-4p7w
MFA bypass in oauth flow in Firefly III
Priority LOW 27
Firefly III is a free and open source personal finance manager.
TI-2024-14686 CVE-2024-22075 · GHSA-vwv2-9wcj-64vx
Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.
Priority LOW 27
Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.
TI-2019-10900 CVE-2019-14672 · GHSA-qc5c-m97j-wqw3
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of…
Priority LOW 26
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field.
TI-2019-10898 CVE-2019-14670 · GHSA-qr4w-v4fh-wx86
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of…
Priority LOW 26
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field.
TI-2019-10897 CVE-2019-14669 · GHSA-84p6-3h2w-fwrg
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of…
Priority LOW 26
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name.
TI-2019-10896 CVE-2019-14668 · GHSA-8r9r-6f5g-px79
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of…
Priority LOW 26
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field.
TI-2019-10254 CVE-2019-13647 · GHSA-pcxq-28f6-m3fm
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of…
Priority LOW 26
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content.
TI-2019-10253 CVE-2019-13646 · GHSA-mrc2-h7q2-pp97
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of…
Priority LOW 26
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.
TI-2019-10252 CVE-2019-13645 · GHSA-5hpw-vcj2-prwg
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of…
Priority LOW 26
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names.
TI-2021-02782 CVE-2021-3851 · GHSA-5fvx-5p2r-4mvp
Open Redirect in firefly-iii/firefly-iii
Priority LOW 25
firefly-iii is vulnerable to URL Redirection to Untrusted Site
TI-2026-49920 CVE-2026-71250 · GHSA-q8pq-98hq-mg7f
Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding
Priority LOW 20
Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated use…
TI-2021-02906 CVE-2021-4015 · GHSA-g6vq-wc8w-4g69
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
Priority LOW 20
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
TI-2021-02900 CVE-2021-4005 · GHSA-hjhp-hwfj-hwf3
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
Priority LOW 20
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)