{"id":"CVE-2019-14669","details":"Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.","modified":"2026-07-08T20:29:22.510894Z","published":"2019-08-05T20:15:12.047Z","references":[{"type":"FIX","url":"https://github.com/firefly-iii/firefly-iii/commit/2ddf48f15cbdbb475221c299872420f625c3bc3f"},{"type":"EVIDENCE","url":"https://github.com/firefly-iii/firefly-iii/issues/2366"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/firefly-iii/firefly-iii","events":[{"introduced":"7d482aa24cf20ce099400618f4089e641da3b930"},{"last_affected":"7d482aa24cf20ce099400618f4089e641da3b930"},{"fixed":"2ddf48f15cbdbb475221c299872420f625c3bc3f"}],"database_specific":{"cpe":"cpe:2.3:a:firefly-iii:firefly_iii:4.7.17.3:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.7.17.3"},{"last_affected":"4.7.17.3"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["4.7.17.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-14669.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}