Firefly III Cross-Site Scripting Vulnerability

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.5. The vulnerability stems from a lack of filtering of user-supplied data in the liabilityname field. An attacker can exploit the vulnerability to...

CVE-2019-14672

Firefly III 4.7.17.5 is vulnerable to a stored XSS due to lack of filtration of user-supplied data in the liability name field. The JavaScript executes upon an error condition during visits to the account show page. Root cause: unsanitized input in the liability name. Impact: stored XSS; no expli...