Vulnerabilidades de Akaunting
CVEs publicadas que afetam produtos de Akaunting: 5 registro(s), com severidade, exploração e correções.
CVE-2026-19198
Alta · 8.7
CWE-863 19/08/2026
Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch
Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.
CVE-2026-11994
Média · 4.8
CWE-79 22/06/2026
Akaunting 3.1.21 - Authenticated stored XSS in report description rendering
Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.
CVE-2026-11943
Média · 4.8
CWE-79 22/06/2026
Akaunting 3.1.21 - Authenticated stored XSS in document timeline
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their own profile name.
CVE-2026-11942
Média · 4.8
CWE-79 22/06/2026
Akaunting 3.1.21 - Stored XSS in delete confirmation modal
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.
CVE-2024-58293
Alta · 8.6
CWE-1336 11/12/2025
Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields
Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.