firefly-iii

Products

Exploited and recent CVEs

• CVE-2026-71250 Medium 4.3 Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding 0.3%
• CVE-2024-37893 Medium 5.9 MFA bypass in oauth flow in Firefly III 0.6%
• CVE-2023-1788 Medium 5.4 Insufficient Session Expiration in firefly-iii/firefly-iii 0.4%
• CVE-2023-1789 Medium 5.2 Improper Input Validation in firefly-iii/firefly-iii 0.3%
• CVE-2023-0298 Medium 6.5 Incorrect Authorization in firefly-iii/firefly-iii 0.6%
• CVE-2021-4005 Medium 4.3 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii 0.4%
• CVE-2021-4015 Medium 4.3 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii 0.4%
• CVE-2021-3921 Medium 5.4 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii 0.4%
• CVE-2021-3901 Low 3.5 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii 0.6%
• CVE-2021-3900 Medium 4.3 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii 0.6%
• CVE-2021-3851 Medium 5.0 Open Redirect in firefly-iii/firefly-iii 0.6%
• CVE-2021-3846 Medium 6.3 Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii 0.8%
• CVE-2021-3819 Medium 4.3 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii 0.5%
• CVE-2021-3730 Medium 6.5 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii 0.5%
• CVE-2021-3729 Medium 4.3 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii 0.4%
• CVE-2021-3728 Medium 6.5 Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii 0.5%
• CVE-2021-3663 Medium 5.3 Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii 0.7%