TI-2020-14020 CVE-2020-21244 · GHSA-rpc9-7g4h-432m
An issue was discovered in FrontAccounting 2.4.7.
Priority LOW 24
An issue was discovered in FrontAccounting 2.4.7.
Vulnerabilities
12 records
TI-2019-04054 CVE-2019-5720 · GHSA-p559-4mqq-cvfv
includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection…
Priority MEDIUM 45
includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of the application via the void_transaction…
TI-2018-16109 CVE-2018-1000890 · GHSA-q6pj-fv68-qfxx
FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the…
Priority LOW 36
FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application.
TI-2018-05198 CVE-2018-7176 · GHSA-j74g-h82x-vgj7
FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via…
Priority MEDIUM 43
FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page).
TI-2014-03240 CVE-2014-3973 · GHSA-qxg2-5v46-34vp
Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.3.21 allow remote…
Priority LOW 36
Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
TI-2011-03297 CVE-2011-3740 · GHSA-vhqw-qpmx-vwmr
FrontAccounting 2.3.1 allows remote attackers to obtain sensitive information via a…
Priority LOW 26
FrontAccounting 2.3.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by reporting/includes/fpdi/fpdi2…
TI-2009-03837 CVE-2009-4046 · GHSA-25px-mjfm-j7v4
Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow…
Priority LOW 35
Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exc…
TI-2009-03836 CVE-2009-4045 · GHSA-g7gp-8rqr-gjrh
Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote…
Priority LOW 35
Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to various .inc and .php files in (1) reporting/, (2) sales/…
TI-2009-03828 CVE-2009-4037 · GHSA-rf54-w24v-682q
Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x…
Priority LOW 35
Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x before 2.2 RC, allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) admin/db/users_db.inc, and…
TI-2007-04959 CVE-2007-5148 · GHSA-rvpr-2mjf-wch6
Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.12 allow…
Priority LOW 32
Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.12 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter to (1) access/logout.php or certain PHP scripts…
TI-2007-04929 CVE-2007-5117 · GHSA-5xrf-9rc2-jr45
Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when…
Priority MEDIUM 46
Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter to (1) acces…
TI-2007-04142 CVE-2007-4279 · GHSA-p25j-m6wj-r6qj
PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31…
Priority HIGH 72
PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter.