Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: Akaunting Component: Akaunting Clear all filters
TI-2020-13940 CVE-2020-20908 · GHSA-v727-f8xf-p82m

Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS)…

Priority LOW 25

Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Company Name input field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00615 Published 2021-10-25 No fix listed CWE-79
TI-2021-14925 CVE-2021-36805 · GHSA-cxpv-7632-3645

Akaunting Invoice Footer Persistent XSS

Priority LOW 25

Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the sales invoice processing component of the application.

CVSS 3.1MEDIUM 5.2 Network High privileges User interaction EPSS 0.00625 Published 2021-08-04 No fix listed CWE-79
TI-2021-14924 CVE-2021-36804 · GHSA-246r-r2wf-frhx

Akaunting Password Reset Relay

Priority LOW 37

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00957 Published 2021-08-04 Fixed in 2.1.13 CWE-640
TI-2021-14923 CVE-2021-36803 · GHSA-6qpx-rx7g-pcgc

Akaunting Avatar Persistent XSS

Priority LOW 29

Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00616 Published 2021-08-04 No fix listed CWE-79
TI-2021-14922 CVE-2021-36802 · GHSA-v8vg-wm76-qrfq

Akaunting DoS via User-Controlled 'locale' Variable

Priority LOW 31

Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0098 Published 2021-08-04 No fix listed CWE-248
TI-2021-14921 CVE-2021-36801 · GHSA-v2vq-4xf4-c37j

Akaunting Authentication Bypass in Company Selection

Priority LOW 37

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0].

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01068 Published 2021-08-04 No fix listed CWE-639
TI-2021-14920 CVE-2021-36800 · GHSA-2wq2-vmgv-993c

Akaunting OS Command Injection in 'Money.php'

Priority MEDIUM 42

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01499 Published 2021-08-04 No fix listed CWE-94