312 matches found
CVE-2026-71250
Firefly III is reported vulnerable due to IsValidWebhookUrl.php: the validator explicitly allows any address in 127.0.0.0/8, enabling an authenticated user with webhooks enabled to configure a webhook targeting loopback services on the server. Furthermore, the validator resolves the target once v...
CVE-2026-71250 Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding
Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...
EUVD-2026-53323
Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...
CVE-2026-50886
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
PT-2026-49327
Name of the Vulnerable Software and Affected Versions Project Firefly III version 6.5.9 Description Incorrect access control in the webhook management component allows attackers to scan internal resources by sending a crafted POST request. Recommendations At the moment, there is no information...
CVE-2026-50886
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...
CVE-2026-50886
Summary: CVE-2026-50886 describes an access-control flaw in the webhook management component of Project Firefly III (version 6.5.9). The root cause is an incorrect access-control implementation, enabling an attacker to scan internal resources by sending a crafted POST request. Affected software: ...
Incorrect Authorization
Overview grumpydictator/firefly-iii is a personal finances manager. Affected versions of this package are vulnerable to Incorrect Authorization via the index and show functions in the user management API endpoints, which lack proper role verification. An attacker can access sensitive information...
EUVD-2021-2531
Malware in sbrugna...
EUVD-2019-5827
Malware in sbrugna...
EUVD-2021-1674
Malware in sbrugna...
EUVD-2021-1958
Malware in sbrugna...
EUVD-2021-2086
Malware in sbrugna...
EUVD-2021-2518
Malware in sbrugna...
EUVD-2021-1937
Malware in sbrugna...
EUVD-2021-1572
Malware in sbrugna...
EUVD-2019-5825
Malware in sbrugna...
EUVD-2021-1725
Malware in sbrugna...