firefly-iii

16 results · Clear filters · Feed

• Medium 4.3
  CVE-2026-71250

  Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding

  Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user (with webhooks enabled, which is off …

  firefly-iii firefly-iii
  Aug 5, 2026
• Medium 5.9
  CVE-2024-37893

  MFA bypass in oauth flow in Firefly III

  Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly …

  firefly-iii firefly-iii grumpydictator/firefly-iii Packagist
  Jun 17, 2024
• Medium 5.4
  CVE-2023-1788

  Insufficient Session Expiration in firefly-iii/firefly-iii

  Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Apr 5, 2023
• Medium 5.2
  CVE-2023-1789

  Improper Input Validation in firefly-iii/firefly-iii

  Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Apr 1, 2023
• Medium 6.5
  CVE-2023-0298

  Incorrect Authorization in firefly-iii/firefly-iii

  Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Jan 14, 2023
• Medium 4.3
  CVE-2021-4005

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Dec 4, 2021
• Medium 4.3
  CVE-2021-4015

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Dec 1, 2021
• Medium 5.4
  CVE-2021-3921

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Nov 13, 2021
• Medium 4.3
  CVE-2021-3900

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Oct 27, 2021
• Medium 5.0
  CVE-2021-3851

  Open Redirect in firefly-iii/firefly-iii

  firefly-iii is vulnerable to URL Redirection to Untrusted Site

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Oct 19, 2021
• Medium 6.3
  CVE-2021-3846

  Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Oct 19, 2021
• Medium 4.3
  CVE-2021-3819

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Sep 27, 2021
• Medium 6.5
  CVE-2021-3730

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Aug 23, 2021
• Medium 4.3
  CVE-2021-3729

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Aug 23, 2021
• Medium 6.5
  CVE-2021-3728

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Aug 23, 2021
• Medium 5.3
  CVE-2021-3663

  Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Jul 25, 2021