Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tag_number$ tag summary page. NOTE: It is asserted that an attacker must have the same acces...
5.4CVSS
5.3AI Score
0.001EPSS
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing. NOTE: It is asserted that an attacker must have the same access rights as the user in or...
5.4CVSS
5.3AI Score
0.001EPSS
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability
5.4CVSS
5.3AI Score
0.001EPSS
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rights as the user in ...
5.4CVSS
5.3AI Score
0.001EPSS
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.
6.1CVSS
6AI Score
0.001EPSS
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link.
5.4CVSS
5.2AI Score
0.001EPSS
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.
5.4CVSS
5.2AI Score
0.001EPSS
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.
5.4CVSS
5.2AI Score
0.001EPSS
Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
3.3CVSS
3.9AI Score
0.0004EPSS
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.
5.4CVSS
5.2AI Score
0.001EPSS
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
7.5CVSS
7.4AI Score
0.002EPSS
6.5CVSS
6.4AI Score
0.001EPSS
4.3CVSS
4.5AI Score
0.001EPSS
6.5CVSS
6.4AI Score
0.001EPSS
8.8CVSS
8.7AI Score
0.001EPSS
8.8CVSS
8.5AI Score
0.001EPSS
5.4CVSS
5.3AI Score
0.001EPSS
6.5CVSS
6.4AI Score
0.001EPSS
8.8CVSS
8.7AI Score
0.001EPSS
4.3CVSS
4.5AI Score
0.001EPSS
4.3CVSS
4.6AI Score
0.001EPSS
4.3CVSS
4.5AI Score
0.001EPSS
Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
6.5CVSS
6.4AI Score
0.001EPSS
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
9.8CVSS
6.3AI Score
0.002EPSS
Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
9.8CVSS
6.2AI Score
0.002EPSS
6.1CVSS
6.2AI Score
0.0005EPSS
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from oth...
5.9CVSS
6AI Score
0.0004EPSS