Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Firefly Iii

First CVE: Jul 18, 2019Active for: 7 yearsTotal CVEs: 52

Firefly III is a personal finance management application that serves as a self-hosted budgeting and accounting tool for individual users and small organizations. Despite a narrow product portfolio, the application occupies a more prominent position in vulnerability disclosures than its user base might suggest, reflecting the security scrutiny applied to open-source financial software. The vendor's vulnerability profile does not exhibit patterns of critical severity, widespread in-the-wild exploitation, or abundant public exploit availability, making it a lower-urgency tracking target compared to widely embedded or internet-facing software. Defenders deploying this application should treat updates as routine maintenance aligned with standard patch-management practices rather than as high-priority security incidents. Current severity, exploitation activity, and exposure counts are shown alongside this summary.

FAUCET AI Generated
26
Total CVEs
More Total CVEs than 97% of tracked vendors
6.5
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 98% of tracked vendors
6.2
Avg CVSS Score
Higher Avg CVSS Score than 35% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Firefly Iii over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jul 18, 2019
7 years ago
Most Recent CVE
Jan 5, 2024
931 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (26 CVEs).

26 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2023-1789CRITICAL
Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
Apr 1, 20239.831NONO
CVE-2023-1788CRITICAL
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
Apr 5, 20239.829NONO
CVE-2021-3901HIGH
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Oct 27, 20218.828NONO
CVE-2021-3846HIGH
firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
Oct 19, 20218.827NONO
CVE-2021-3663HIGH
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
Jul 25, 20217.524NONO
CVE-2023-0298MEDIUM
Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
Jan 14, 20236.523NONO
CVE-2021-3819HIGH
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Sep 27, 20218.822NONO
CVE-2021-3728MEDIUM
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aug 23, 20216.522NONO
CVE-2019-14667MEDIUM
Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name
Aug 5, 20196.121NONO
CVE-2021-3851MEDIUM
firefly-iii is vulnerable to URL Redirection to Untrusted Site
Oct 19, 20215.420NONO
View all 26 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products26 CVEs
73%
15%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local1 (3.8%)
Network25 (96.2%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low26 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (23.1%)
Unknown0 (0.0%)
Required20 (76.9%)
Privileges Required
Low12 (46.2%)
High0 (0.0%)
None14 (53.8%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (26 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Firefly Iii.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Firefly Iii — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Firefly Iii's Products

View all 2 CNAs →

Top CWEs