320 matches found
CVE-2026-71250
Firefly III is reported vulnerable due to IsValidWebhookUrl.php: the validator explicitly allows any address in 127.0.0.0/8, enabling an authenticated user with webhooks enabled to configure a webhook targeting loopback services on the server. Furthermore, the validator resolves the target once v...
EUVD-2026-53323
Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...
CVE-2026-71250 Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding
Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...
CVE-2026-71250: Server-Side Request Forgery (SSRF)
Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...
GHSA-9MMG-Q95P-GP67 Project Firefly III has incorrect access control in the webhook management component
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
Project Firefly III has incorrect access control in the webhook management component
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
Access Control Bypass
Overview grumpydictator/firefly-iii is a personal finances manager. Affected versions of this package are vulnerable to Access Control Bypass via the webhook management component. An attacker can access internal resources by sending a crafted POST request. Remediation There is no fixed version fo...
CVE-2026-50886
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
PT-2026-49327
Name of the Vulnerable Software and Affected Versions Project Firefly III version 6.5.9 Description Incorrect access control in the webhook management component allows attackers to scan internal resources by sending a crafted POST request. Recommendations At the moment, there is no information...
CVE-2026-50886: Improper Access Control
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
CVE-2026-50886
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
CVE-2026-50886
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
CVE-2026-50886
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
Incorrect Authorization
Overview grumpydictator/firefly-iii is a personal finances manager. Affected versions of this package are vulnerable to Incorrect Authorization via the index and show functions in the user management API endpoints, which lack proper role verification. An attacker can access sensitive information...
EUVD-2021-2531
Malware in sbrugna...
EUVD-2019-5827
Malware in sbrugna...
EUVD-2021-1674
Malware in sbrugna...
EUVD-2021-1937
Malware in sbrugna...