Vulnerabilities

TI-2026-85247 CVE-2026-86041

Source-IP allowlist bypass via spoofed X-Forwarded-For in ezBookkeeping

MEDIUM 57

ezBookkeeping is an open source, self-hosted personal finance application.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00221 Published 2026-11-04 Fixed in 1.6.0 CWE-348

TI-2026-67507 CVE-2026-105131 · GHSA-983g-gj75-pg7f

mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

LOW 23

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00198 Published 2026-10-04 Fixed in 2.0.1 CWE-863

TI-2026-63328 CVE-2026-94112 · GHSA-j95g-6g2h-3f33

mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

LOW 33

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00393 Published 2026-09-20 Fixed in 2.0.0 CWE-294

TI-2025-40384 CVE-2025-65519 · GHSA-f2fg-5m3g-hqwv

mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in…

MEDIUM 62

mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00335 Published 2026-02-18 No fix listed CWE-674

TI-2024-37958 CVE-2024-57604 · GHSA-mpg8-8x9c-p9gv

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.

HIGH 82

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00736 Published 2025-02-12 No fix listed CWE-276

TI-2024-37957 CVE-2024-57603 · GHSA-772m-773g-qmhc

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.

MEDIUM 61

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00446 Published 2025-02-12 No fix listed CWE-799

Vulnerabilities

Filters

Source-IP allowlist bypass via spoofed X-Forwarded-For in ezBookkeeping

mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in…

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.