Description
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.
References (3)
Core 3
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991
Patch, Third Party Advisory x_refsource_misc
https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194
Exploit, Third Party Advisory x_refsource_misc
https://github.com/firefly-iii/firefly-iii/issues/2363
Scores
CVSS v3
6.1
EPSS
0.0042
EPSS Percentile
62.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
firefly-iii/firefly_iii
4.7.17.4
Published
Aug 05, 2019
Tracked Since
Feb 18, 2026