← Back

Fava

fava

Vendor: Fava Project • 3 CVEs

CVEs (3)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-2589
1Fava Project
1Fava
Jun 17, 2026
Aug 1, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.
CVE-2022-2523
1Fava Project
1Fava
Jun 17, 2026
Jul 25, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
CVE-2022-2514
1Fava Project
1Fava
Jun 17, 2026
Jul 25, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.