Known vulnerabilities in Firefly III

Vendor: James Cole
Software: Firefly III
Software CPE: cpe:2.3:a:james_cole:firefly_iii:*:*:*:*:*:*:*:*
Total vulnerabilities: 23
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Firefly III Firefly III is affected by 23 known vulnerabilities: 1 high, 5 medium, 17 low Critical High Medium Low

Vulnerabilities (23)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU150157 - Incorrect Authorization
CWE-863 Low
No
No
6.6.6 16.09.2026 SB2026091614
#VU123612 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
6.5.1 06.03.2026 SB2026030631
#VU92253 - Authentication Bypass Using an Alternate Path or Channel
CVE-2024-37893
CWE-288 Low
No
No
6.1.18 19.06.2024 SB2024061943
#VU132079 - Improper Neutralization of Formula Elements in a CSV File
CWE-1236 Medium
No
No
6.1.7 31.01.2024 SB2024013168
#VU84779 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
6.1.1 26.12.2023 SB2023122624
#VU58380 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
5.6.5 26.11.2021 SB2021112604
#VU57179 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-14667
CWE-79 Low
No
No
4.7.17.5 11.10.2021 SB2019080534
#VU57178 - Unrestricted Upload of File with Dangerous Type
CWE-434 High
No
No
5.6.2 11.10.2021 SB2021101102
#VU57177 - URL Redirection to Untrusted Site ('Open Redirect')
CWE-601 Low
No
No
5.6.2 11.10.2021 SB2021101102
#VU56887 - Cross-Site Request Forgery (CSRF)
CVE-2021-3819
CWE-352 Low
No
No
5.6.1 27.09.2021 SB2021092709
#VU56698 - Cross-Site Request Forgery (CSRF)
CVE-2021-3730
CWE-352 Low
No
No
5.6.0 20.09.2021 SB2021092005
#VU56697 - Cross-Site Request Forgery (CSRF)
CVE-2021-3729
CWE-352 Low
No
No
5.6.0 20.09.2021 SB2021092005
#VU56696 - Cross-Site Request Forgery (CSRF)
CVE-2021-3728
CWE-352 Low
No
No
5.6.0 20.09.2021 SB2021092005
#VU55292 - Improper Restriction of Excessive Authentication Attempts
CVE-2021-3663
CWE-307 Medium
No
No
5.5.13, 5.6.0 26.07.2021 SB2021072604
SB2021092005
#VU19953 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-14672
CWE-79 Low
No
No
4.7.17.4 07.08.2019 SB2019080510
#VU19952 - Exposure of sensitive information to an unauthorized actor
CVE-2019-14671
CWE-200 Medium
No
No
4.7.17.4 07.08.2019 SB2019080509
#VU19951 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-14670
CWE-79 Low
No
No
4.7.17.4 07.08.2019 SB2019080508
#VU19950 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-14669
CWE-79 Low
No
No
4.7.17.4 07.08.2019 SB2019080507
#VU19949 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-14668
CWE-79 Low
No
No
4.7.17.4 07.08.2019 SB2019080506
#VU19356 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-13644
CWE-79 Medium
No
No
4.7.17.1 24.07.2019 SB2019071809


Showing elements 1 - 20 out of 23