CVE-2019-14667

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.

• CWE-79

• https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194Patch, Third Party Advisory
• https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991Patch, Third Party Advisory
• https://github.com/firefly-iii/firefly-iii/issues/2363Exploit, Third Party Advisory
• https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194Patch, Third Party Advisory
• https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991Patch, Third Party Advisory
• https://github.com/firefly-iii/firefly-iii/issues/2363Exploit, Third Party Advisory

Published

Aug 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1466An information disclosure vulnerability exists when the Wind…6.5
• CVE-2019-14662Brandy 1.20.1 has a stack-based buffer overflow in fileio_op…
• CVE-2019-14663Brandy 1.20.1 has a stack-based buffer overflow in fileio_op…
• CVE-2019-14664In Enigmail below 2.1, an attacker in possession of PGP encr…6.5
• CVE-2019-14665Brandy 1.20.1 has a heap-based buffer overflow in define_arr…
• CVE-2019-14666GLPI through 9.4.3 is prone to account takeover by abusing t…8.8
• CVE-2019-14668Firefly III 4.7.17.3 is vulnerable to stored XSS due to the …
• CVE-2019-14669Firefly III 4.7.17.3 is vulnerable to stored XSS due to the …
• CVE-2019-1467An information disclosure vulnerability exists when the Wind…6.5
• CVE-2019-14670Firefly III 4.7.17.3 is vulnerable to stored XSS due to the …
• CVE-2019-14671Firefly III 4.7.17.3 is vulnerable to local file enumeration…
• CVE-2019-14672Firefly III 4.7.17.5 is vulnerable to stored XSS due to the …