TI-2024-15147 CVE-2024-22836 · GHSA-5h74-7w4c-g92x
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.
Priority HIGH 76
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.
Akaunting
Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
Akaunting records in CISA KEVNo Akaunting vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
11 records in Akaunting · all components
TI-2025-35028 CVE-2025-55522 · GHSA-w7gm-cfx6-4272
Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting…
Priority MEDIUM 62
Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.
TI-2025-35027 CVE-2025-55521 · GHSA-f652-3262-ch4x
An issue in the component /settings/localisation of Akaunting v3.1.18 allows…
Priority MEDIUM 62
An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via a crafted POST request.
TI-2021-14920 CVE-2021-36800 · GHSA-2wq2-vmgv-993c
Akaunting OS Command Injection in 'Money.php'
Priority MEDIUM 42
Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application.
TI-2020-14331 CVE-2020-22390 · GHSA-jg4q-mprj-p635
Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function.
Priority MEDIUM 41
Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function.
TI-2021-14924 CVE-2021-36804 · GHSA-246r-r2wf-frhx
Akaunting Password Reset Relay
Priority LOW 37
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e…
TI-2021-14921 CVE-2021-36801 · GHSA-v2vq-4xf4-c37j
Akaunting Authentication Bypass in Company Selection
Priority LOW 37
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0].
TI-2021-14922 CVE-2021-36802 · GHSA-v8vg-wm76-qrfq
Akaunting DoS via User-Controlled 'locale' Variable
Priority LOW 31
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request.
TI-2021-14923 CVE-2021-36803 · GHSA-6qpx-rx7g-pcgc
Akaunting Avatar Persistent XSS
Priority LOW 29
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images.
TI-2021-14925 CVE-2021-36805 · GHSA-cxpv-7632-3645
Akaunting Invoice Footer Persistent XSS
Priority LOW 25
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the sales invoice processing component of the application.
TI-2020-13940 CVE-2020-20908 · GHSA-v727-f8xf-p82m
Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS)…
Priority LOW 25
Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Company Name input field.