VYPR

Packagist (Composer) package

grumpydictator/firefly-iii

pkg:composer/grumpydictator/firefly-iii

Vulnerabilities (23)

  • CVE-2026-50886CriJun 15, 2026
    affected <= 6.5.9

    Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

  • CVE-2024-37893MedJun 17, 2024
    affected < 6.1.17fixed 6.1.17

    Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwo

  • CVE-2024-22075MedJan 5, 2024
    affected < 6.1.1fixed 6.1.1

    Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.

  • CVE-2023-1788CriApr 5, 2023
    affected < 6.0.0fixed 6.0.0

    Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.

  • CVE-2023-1789CriApr 1, 2023
    affected < 6.0.0fixed 6.0.0

    Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.

  • CVE-2023-0298MedJan 14, 2023
    affected < 5.8.0fixed 5.8.0

    Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.

  • CVE-2021-4005MedDec 4, 2021
    affected < 5.6.5fixed 5.6.5

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  • CVE-2021-4015MedDec 1, 2021
    affected < 5.6.5fixed 5.6.5

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  • CVE-2021-3921MedNov 13, 2021
    affected < 5.6.3fixed 5.6.3

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  • CVE-2021-3901HigOct 27, 2021
    affected <= 5.6.2

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  • CVE-2021-3900MedOct 27, 2021
    affected <= 5.6.2

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  • CVE-2021-3851MedOct 19, 2021
    affected < 5.6.2fixed 5.6.2

    firefly-iii is vulnerable to URL Redirection to Untrusted Site

  • CVE-2021-3846HigOct 19, 2021
    affected < 5.6.2fixed 5.6.2

    firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type

  • CVE-2021-3819HigSep 27, 2021
    affected < 5.6.1fixed 5.6.1

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  • CVE-2021-3730MedAug 23, 2021
    affected < 5.6.0fixed 5.6.0

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  • CVE-2021-3729MedAug 23, 2021
    affected < 5.6.0fixed 5.6.0

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  • CVE-2021-3728MedAug 23, 2021
    affected < 5.6.0fixed 5.6.0

    firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  • CVE-2021-3663HigJul 25, 2021
    affected < 5.5.13fixed 5.5.13

    firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts

  • CVE-2019-14671LowAug 5, 2019
    affected < 4.7.17.4fixed 4.7.17.4

    Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.

  • CVE-2019-13647MedJul 18, 2019
    affected < 4.7.17.3fixed 4.7.17.3

    Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rig

Page 1 of 2