Lucene search
Veracode Vulnerability DatabaseVERACODE:20849HistoryJul 18, 2019 - 5:59 a.m.
Cross-site Scripting (XSS)
2019-07-1805:59:47
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
EPSS
0.001
Percentile
21.4%
grumpydictator/firefly-iii is vulnerable to cross-site scripting (XSS). The attack is possible because it does not escape the user provided data in budget name, allowing an attacker to inject malicious script in a transaction to get executed on the tags/show/$tag_number$ tag summary page.
References
github.com/firefly-iii/firefly-iii/blob/45ddb64186e310a004acaf0f3d2766d00841f7f8/.sandstorm/changelog.md
github.com/firefly-iii/firefly-iii/compare/45ddb64186e310a004acaf0f3d2766d00841f7f8...def307010c388c4e92d7066671ad62e477cc087a
github.com/firefly-iii/firefly-iii/compare/76aa8ac...45b8c36
github.com/firefly-iii/firefly-iii/issues/2335
Related
nvd
nvd
CVE-2019-13644
2019-07-18 03:15:10
vulnrichment
vulnrichment
CVE-2019-13644
2019-07-18 02:17:24
osv
osv
Firefly III vulnerable to stored XSS
2022-05-24 16:50:36
cvelist
cvelist
CVE-2019-13644
2019-07-18 02:17:24
github
github
Firefly III vulnerable to stored XSS
2022-05-24 16:50:36
prion
prion
Design/Logic Flaw
2019-07-18 03:15:00
cve
cve
CVE-2019-13644
2019-07-18 03:15:10