CVE-2024-22075

Firefly III before 6.1.1 allows HTML Injection via webhooks due to improper sanitization in webhook handling. Affected product: Firefly III (web application). Root cause: inadequate sanitization of webhook inputs leading to HTML injection. Impact: potential exposure/impact limited to confidential...

CVE-2019-14671

Firefly III 4.7.17.3 is vulnerable to local file enumeration due to insufficient sanitization of protocol schemes, notably file:/// URLs, related to the fints_url used in import/job/configuration and import/create/fints. This affects the ability of an attacker to enumerate local files. The connec...

CVE-2021-3663

Firefly-III is affected by CVE-2021-3663: Improper Restriction of Excessive Authentication Attempts. Affected software is the Firefly-III personal finance manager. Documented severity via CVSSv3.1 base score 7.5 (remote, no authentication, high confidentiality impact; network access, low attack c...

CVE-2021-3730

Technical details (affected versions, components, root cause, or remediation) are not publicly provided in the supplied documents. Monitor for updates from official advisories.

CVE-2021-3728

The provided documents confirm CVE-2021-3728 affects the open-source project firefly-iii and is described as a Cross‑Site Request Forgery (CSRF) vulnerability. Concrete details in the connected documents show the issue is labeled as CSRF across multiple sources (Red Hat, OSV, GitHub advisories, C...

CVE-2021-3901

CVE-2021-3901 affects firefly-iii: Cross-Site Request Forgery (CSRF) in the web application. The vulnerability arises from insufficient request validation, enabling an attacker to cause unintended actions on behalf of authenticated users. CVSS data in the initial document lists CVSS v3.1 base sco...

CVE-2021-3900

CVE-2021-3900 affects firefly-iii and is described in connected sources as a Cross-Site Request Forgery (CSRF) vulnerability. The core issue is that a request could be forged by a logged-in user to perform unwanted actions. Some sources provide a specific exploit scenario: an attacker could, via ...

CVE-2021-3921

CVE-2021-3921 affects firefly-iii. Multiple sources document a Cross-Site Request Forgery (CSRF) vulnerability in firefly-iii that can cause a logged-in user to be logged out via a forged request example (via a GET/ANY login-logout flow). The Huntr entry specifically describes an attacker logging...

CVE-2021-4005

CVE-2021-4005 affects the Firefly-III project and is a Cross-Site Request Forgery (CSRF) vulnerability. Multiple connected records (OSV, GHSA, Red Hat, CNVD, CNVD-CNVD, CNVD-202112-206) describe firefly-iii as vulnerable to CSRF; OSV notes that the CSRF could disable two-factor authentication for...

CVE-2019-14667

Firefly III 4.7.17.4 is affected by multiple stored XSS issues due to insufficient filtering of user-supplied data in the transaction description field and in the asset account name. The JavaScript payload can execute during a convert transaction action. Affected component: the web interface of F...

CVE-2021-3729

CVE-2021-3729 affects the Firefly III project (firefly-iii). The connected documents confirm a Cross-Site Request Forgery (CSRF) vulnerability in firefly-iii but do not provide concrete technical details such as affected versions, root cause, specific components, impact scope, or fixes. The entri...

CVE-2021-3819

CVE-2021-3819 is a Cross-Site Request Forgery (CSRF) vulnerability affecting firefly-iii. The NVD/OSV entries indicate high impact (CVSSv3.1 base score 8.8) with network access, no authentication, and user interaction required, enabling unauthorized requests to the server. The issue is acknowledg...

CVE-2021-3851

CVE-2021-3851 affects firefly-iii (open-source personal finance app). Connected sources describe an Open Redirect vulnerability in the web application, enabling redirection to untrusted sites during a user flow (notably the bills/store flow where aReferer-based redirect can be manipulated to forw...

CVE-2023-0298

CVE-2023-0298 affects the Firefly III project in the GitHub repository firefly-iii/firefly-iii, with an vulnerability described as “Incorrect Authorization” in versions prior to 5.8.0. The connected documents consistently identify this as an authorization issue in the API path and confirm the aff...

CVE-2019-14672

Firefly III 4.7.17.5 is vulnerable to a stored XSS due to lack of filtration of user-supplied data in the liability name field. The JavaScript executes upon an error condition during visits to the account show page. Root cause: unsanitized input in the liability name. Impact: stored XSS; no expli...

CVE-2019-13646

CVE-2019-13646 affects Firefly III prior to 4.7.17.3 with a reflected XSS vulnerability in the search query due to lack of filtration of user-supplied data. Affected product: Firefly III (open-source personal finance manager); root cause: insufficient input filtering in search; impact: potential ...

CVE-2023-1788

CVE-2023-1788 affects Firefly III (firefly-iii/firefly-iii) prior to version 6.0.0, where sessions do not expire promptly after inactivity or on close. The issue is described as insufficient session expiration and is reflected in multiple sources (Red Hat advisory, GitHub advisory, GHSA, OSV, NVD...

CVE-2019-13644

Firefly III prior to 4.7.17.1 is vulnerable to a stored XSS flaw in budget names due to insufficient filtering of user input. The JavaScript payload is stored inside a transaction and executed on the tags/show/$tag_number$ page. The vulnerability requires the attacker to have the same access righ...

CVE-2019-14668

Firefly III 4.7.17.3 is affected by a stored XSS in the transaction description field. The root cause is lack of filtration/sanitization of user-supplied data, allowing JavaScript execution when a transaction link is deleted. Connected sources corroborate a stored XSS in the delete workflow via l...

CVE-2021-4015

CVE-2021-4015 affects the Firefly-III application and is a Cross-Site Request Forgery (CSRF) vulnerability. Multiple connected sources corroborate CSRF as the issue, with details pointing to an exploit path such as "/transactions/link/switch/id" (CNNVD summary). The CVE entry includes a CVSS v3.1...

CVE-2019-14670

Firefly III 4.7.17.3 is reported vulnerable to stored XSS stemming from lack of filtration of user-supplied data in the bill name field. The JavaScript payload executes during rule-from-bill creation, indicating a stored XSS flaw. No explicit remediation or patch details are provided in the conne...

CVE-2019-14669

CVE-2019-14669 affects Firefly III 4.7.17.3 and is a stored XSS vulnerability caused by lack of filtration of user-supplied data in the asset account name. The JavaScript executes when visiting the audit account statistics page. CVSS metrics indicate CVSS‑3.0 base score 5.4 (Medium) with network ...

CVE-2019-13647

Firefly III prior to 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript executes when viewing attachments/view/$file_id$, and an attacker must have the same access rights as the user to exploit. Affected software: Firefly III...

CVE-2021-3846

Firefly-III is reported vulnerable to Unrestricted Upload of File with Dangerous Type. The connected documents identify Firefly-III and an unrestricted upload issue but do not provide concrete technical details (vulnerable component/version, root cause, exploit specifics, or a fixed version) with...

CVE-2019-13645

Firefly III prior to 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript executes during attachments/edit/$file_id$ attachment editing. An attacker must have the same access rights as the user to exploit. A fix is available: upd...

CVE-2023-1789

CVE-2023-1789 affects firefly-iii/firefly-iii prior to 6.0.0. The root cause is improper input validation in the GitHub repository, leading to potential manipulation or disclosure paths. Public sources assign a high-severity impact (NVD CVSS 3.1 base score 9.8: Critical for confidentiality, integ...