CVE-2019-14668

Name of the Vulnerable Software and Affected Versions Firefly III version 4.7.17.3

Description The issue arises from the lack of filtration of user-supplied data in the transaction description field, leading to stored XSS. This allows JavaScript code to be executed during the deletion of a transaction link.

Recommendations For Firefly III version 4.7.17.3, consider disabling the transaction description field until a patch is available to prevent exploitation. Restrict access to the transaction link deletion functionality to minimize the risk of stored XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.