Priority LOW 20
Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated use…
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00276 · Published 2026-08-05 · No fix listed CWE-918
Priority LOW 27
Firefly III is a free and open source personal finance manager.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00594 · Published 2024-06-17 · Fixed in 6.1.17 CWE-287
Priority LOW 27
Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00348 · Published 2024-01-05 · Fixed in 6.1.1 CWE-79
Priority HIGH 75
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00438 · Published 2023-04-05 · Fixed in 6, 6.0.0 CWE-613
Priority HIGH 75
Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00335 · Published 2023-04-01 · Fixed in 6.0.0 CWE-20
Priority MEDIUM 62
Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00643 · Published 2023-01-14 · Fixed in 5.8.0 CWE-863
Priority LOW 20
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2021-12-04 · Fixed in 5.6.6, 5.6.5 CWE-352
Priority LOW 20
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2021-12-01 · Fixed in 5.6.4, 5.6.5 CWE-352
Priority LOW 20
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2021-11-13 · Fixed in 5.6.3 CWE-352
Priority LOW 39
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00554 · Published 2021-10-27 · No fix listed CWE-352
Priority LOW 30
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00551 · Published 2021-10-27 · No fix listed CWE-352
Priority LOW 25
firefly-iii is vulnerable to URL Redirection to Untrusted Site
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00571 · Published 2021-10-19 · Fixed in 5.6.2 CWE-601
Priority LOW 39
firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00779 · Published 2021-10-19 · Fixed in 5.6.2 CWE-434
Priority LOW 39
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00541 · Published 2021-09-27 · Fixed in 5.6.1 CWE-352
Priority LOW 29
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00475 · Published 2021-08-23 · Fixed in 5.6.0 CWE-352
Priority LOW 20
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00405 · Published 2021-08-23 · Fixed in 5.6.0 CWE-352
Priority LOW 29
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00501 · Published 2021-08-23 · Fixed in 5.6.0 CWE-352
Priority LOW 34
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0071 · Published 2021-07-25 · Fixed in 5.5.13 CWE-307
Priority LOW 30
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01327 · Published 2019-08-05 · No fix listed CWE-79
Priority LOW 26
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00762 · Published 2019-08-05 · No fix listed CWE-79
Priority LOW 26
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00762 · Published 2019-08-05 · No fix listed CWE-79
Priority LOW 26
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00762 · Published 2019-08-05 · No fix listed CWE-79
Priority LOW 16
Firefly III 4.7.17.3 is vulnerable to local file enumeration.
CVSS 3.0LOW 3.3· Local · Low privileges · No interaction · EPSS 0.00472 · Published 2019-08-05 · Fixed in 4.7.17.4 CWE-20
Priority LOW 26
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00744 · Published 2019-08-05 · No fix listed CWE-79
Priority LOW 26
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00748 · Published 2019-07-18 · Fixed in 4.7.17.3 CWE-79
Load more
THREATIST.IORead the docs