Vendor
Akaunting
15 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
High 7.0
Akaunting 3.3.0 - Stored XSS through imported item names
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting…
-
High 8.8
Akaunting before 2.1.31 OS Command Injection via app alias
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metachar…
-
High 8.7
Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch
Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.
-
High 8.1
CVE-2026-16772
In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes us…
-
High 8.6
Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields
Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor na…
-
High 8.1
Akaunting Authentication Bypass in Company Selection
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product.
-
High 8.7
Akaunting OS Command Injection in 'Money.php'
Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invoices/{invoice_id} with an items[0][price] that includes a PHP callable function is executed directly…