Cross-Site Request Forgery in firefly-iii

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-3901 · ADVISORY
• firefly-iii/firefly-iii commit b42d8d1 · WEB
• firefly-iii/firefly-iii · PACKAGE
• huntr.dev/bounties/62508fdc-c26b-4312-bf75-fd3a3f997464 · WEB

Mais vulnerabilidades de grumpydictator/firefly-iii

• CVE-2026-50886CRÍTICO 9.1Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a…
• GHSA-6jq6-x4cx-qvcmMÉDIOFirefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
• GHSA-5q8v-j673-m5v4MÉDIOFirefly III user API endpoints expose all users' information to any authenticated user (IDOR)
• CVE-2024-37893MÉDIO 5.9Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow m…
• GHSA-29w6-c52g-m8jcMÉDIO 4.0C5 Firefly III CSV Injection.