MediumCVSS 6.1
EPSS 0.75%
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.
Product
debian/fava vulnerabilities
3 published CVES affecting debian/fava, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 3
- Critical
- 0
- High
- 0
- Medium
- 3
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest debian/fava CVEs
Newest publication first
-
-
MediumCVSS 6.1 EPSS 0.87%
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
-
MediumCVSS 6.1 EPSS 0.87%
The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.