Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

grumpydictator/firefly-iii

23 known vulnerabilities (1 critical, 17 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
23 · 1 critical, 17 medium, 1 low
Registry
Packagist

Advisories 23

  • CVE-2026-50886Critical 9.1

    Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via…

    Affected: through 6.5.9.

  • CVE-2024-37893Medium 5.9

    MFA bypass in oauth flow in Firefly III

    Affected: fixed in 6.1.17.

  • CVE-2024-22075Medium 6.1

    Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.

    Affected: fixed in 6.1.1.

  • CVE-2023-1788Medium 5.4

    Insufficient Session Expiration in firefly-iii/firefly-iii

    Affected: fixed in 6.0.0.

  • CVE-2023-1789Medium 5.2

    Improper Input Validation in firefly-iii/firefly-iii

    Affected: fixed in 6.0.0.

  • CVE-2023-0298Medium 6.5

    Incorrect Authorization in firefly-iii/firefly-iii

    Affected: fixed in 5.8.0.

  • CVE-2021-4005Medium 4.3

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    Affected: fixed in 5.6.5.

  • CVE-2021-4015Medium 4.3

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    Affected: fixed in 5.6.5.

  • CVE-2021-3921Medium 5.4

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    Affected: fixed in 5.6.3.

  • Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    Affected: through 5.6.2.

  • CVE-2021-3900Medium 4.3

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    Affected: through 5.6.2.

  • CVE-2021-3851Medium 5.0

    Open Redirect in firefly-iii/firefly-iii

    Affected: fixed in 5.6.2.

  • CVE-2021-3846Medium 6.3

    Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii

    Affected: fixed in 5.6.2.

  • CVE-2021-3819Medium 4.3

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    Affected: fixed in 5.6.1.

  • CVE-2021-3730Medium 6.5

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    Affected: fixed in 5.6.0.

Show all 23 advisoriesShow fewer advisories
  • CVE-2021-3729Medium 4.3

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    Affected: fixed in 5.6.0.

  • CVE-2021-3728Medium 6.5

    Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

    Affected: fixed in 5.6.0.

  • CVE-2021-3663Medium 5.3

    Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii

    Affected: fixed in 5.5.13.

  • Firefly III 4.7.17.3 is vulnerable to local file enumeration.

    Affected: fixed in 4.7.17.4.

  • Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content.

    Affected: fixed in 4.7.17.3.

  • Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.

    Affected: fixed in 4.7.17.3.

  • Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names.

    Affected: fixed in 4.7.17.3.

  • CVE-2019-13644Medium 5.4

    Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name.

    Affected: fixed in 4.7.17.1.