Veille CVE

Recherche « akaunting »

8 CVE

Critique 0 Élevée 3 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « akaunting » ✕
  1. CVE-2022-51019 8.8 Élevée

    akaunting

    Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.

  2. CVE-2026-19198 8.7 Élevée

    Akaunting

    Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.

  3. CVE-2026-16772 8.1 Élevée

    Akaunting

    In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by this issue. This vulnerability has been remediated in v3.2.0, commit 80ef6d3b154a.

  4. CVE-2026-71251 6.5 Moyenne

    akaunting

    Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any authenticated portal customer to download any other company's uploaded files by guessing or enumerating media IDs.

  5. CVE-2026-11994 4.8 Moyenne

    Akaunting

    Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.

  6. CVE-2026-11943 4.8 Moyenne

    Akaunting

    Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their own profile name.

  7. CVE-2026-11942 4.8 Moyenne

    Akaunting

    Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.

  8. CVE-2026-8193 6.3 Moyenne

    Akaunting

    A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.