Firefly-iii Firefly Iii — known CVE vulnerabilities

Every CVE whose affected-product data names Firefly-iii Firefly Iii, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (26)

• CVE-2023-1788 — CVSS 9.8 (critical): Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
• CVE-2023-1789 — CVSS 9.8 (critical): Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
• CVE-2021-3901 — CVSS 8.8 (high): firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-3819 — CVSS 8.8 (high): firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-3846 — CVSS 8.8 (high): firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
• CVE-2021-3663 — CVSS 7.5 (high): firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
• CVE-2021-3900 — CVSS 6.5 (medium): firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2023-0298 — CVSS 6.5 (medium): Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
• CVE-2021-3728 — CVSS 6.5 (medium): firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-3730 — CVSS 6.5 (medium): firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2024-22075 — CVSS 6.1 (medium): Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.
• CVE-2019-14667 — CVSS 6.1 (medium): Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction…
• CVE-2019-14670 — CVSS 5.4 (medium): Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript…
• CVE-2019-13647 — CVSS 5.4 (medium): Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The…
• CVE-2019-13646 — CVSS 5.4 (medium): Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is…
• CVE-2019-13645 — CVSS 5.4 (medium): Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript…
• CVE-2021-3851 — CVSS 5.4 (medium): firefly-iii is vulnerable to URL Redirection to Untrusted Site
• CVE-2019-14669 — CVSS 5.4 (medium): Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The…
• CVE-2019-14668 — CVSS 5.4 (medium): Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field…
• CVE-2019-14672 — CVSS 5.4 (medium): Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The…
• CVE-2019-13644 — CVSS 5.4 (medium): Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript…
• CVE-2021-3921 — CVSS 4.3 (medium): firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-3729 — CVSS 4.3 (medium): firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-4005 — CVSS 4.3 (medium): firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2021-4015 — CVSS 4.3 (medium): firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2019-14671 — CVSS 3.3 (low): Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme…