| Package | Affected versions | Patched versions |
|---|---|---|
| grumpydictator/firefly-iii | < 4.7.17.3 | 4.7.17.3 |
| firefly iii | < 4.7.17.3 | 4.7.17.3 |
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free