Security
فارسی
All products

grumpydictator/firefly-iii

Composer · Package
26 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)GHSA-6JQ6-X4CX-QVCM grumpydictator/firefly-iii Composer Medium Fix reported
Project Firefly III has incorrect access control in the webhook management componentCVE-2026-50886 · GHSA-9MMG-Q95P-GP67 grumpydictator/firefly-iii Composer Critical No fix reported
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)GHSA-5Q8V-J673-M5V4 grumpydictator/firefly-iii Composer Medium Fix reported
Firefly III allows webhooks HTML Injection.CVE-2024-22075 · GHSA-VWV2-9WCJ-64VX grumpydictator/firefly-iii Composer Medium Fix reported
C5 Firefly III CSV Injection.GHSA-29W6-C52G-M8JC grumpydictator/firefly-iii Composer Medium Fix reported
Firefly III vulnerable to stored XSSCVE-2019-13644 · GHSA-9XMX-RJ7J-FV9Q grumpydictator/firefly-iii Composer Medium Fix reported
Firefly III has a MFA bypass in oauth flowCVE-2024-37893 · GHSA-4GM4-C4MH-4P7W grumpydictator/firefly-iii Composer Medium Fix reported
Firefly III insufficiently expires sessionsCVE-2023-1788 · GHSA-H7VV-46P5-PRMH grumpydictator/firefly-iii Composer Medium Fix reported
Open Redirect in firefly-iiiCVE-2021-3851 · GHSA-5FVX-5P2R-4MVP grumpydictator/firefly-iii Composer Medium Fix reported
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-3730 · GHSA-C676-MCW3-QG55 grumpydictator/firefly-iii Composer Medium Fix reported
Firefly III vulnerable to reflected cross-site scriptingCVE-2019-13646 · GHSA-MRC2-H7Q2-PP97 grumpydictator/firefly-iii Composer Medium Fix reported
Unrestricted File Upload vulnerability in Firefly IIICVE-2021-3846 · GHSA-5GQ7-826W-8282 grumpydictator/firefly-iii Composer High Fix reported
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-3729 · GHSA-GP6W-CCQV-P7QR grumpydictator/firefly-iii Composer Medium Fix reported
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-3728 · GHSA-XP5Q-77MH-6HM2 grumpydictator/firefly-iii Composer Medium Fix reported
Firefly III vulnerable to stored XSSCVE-2019-13645 · GHSA-5HPW-VCJ2-PRWG grumpydictator/firefly-iii Composer Medium Fix reported
No Restriction of Excessive Authentication Attempts in Firefly IIICVE-2021-3663 · GHSA-56CX-WF47-HX7W grumpydictator/firefly-iii Composer Medium Fix reported
Firefly III vulnerable to image-based stored XSSCVE-2019-13647 · GHSA-PCXQ-28F6-M3FM grumpydictator/firefly-iii Composer Medium Fix reported
Firefly III vulnerable to improper input validationCVE-2023-1789 · GHSA-MWXW-HXVP-4R2R grumpydictator/firefly-iii Composer Medium Fix reported
Improper Authorization in grumpydictator/firefly-iiiCVE-2023-0298 · GHSA-7MC4-JP4F-V2J2 grumpydictator/firefly-iii Composer Medium Fix reported
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4015 · GHSA-G6VQ-WC8W-4G69 grumpydictator/firefly-iii Composer Medium Fix reported