CVE-2026-40524

🗓️ 29 Jun 2026 12:27:26Reported by VulnCheckType

CVE-2026-40524: FrontAccounting below 2.4.20 has SQL injection in get_gl_transactions() via a non-parameterized filter_type in IN(), enabling data extraction with SA_GLANALYTIC.

Reporter	Title	Published	Views	Family All 6
ATTACKERKB	CVE-2026-40524	29 Jun 202612:27	–	attackerkb
Circl	CVE-2026-40524	29 Jun 202615:16	–	circl
Cvelist	CVE-2026-40524 FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()	29 Jun 202612:27	–	cvelist
EUVD	EUVD-2026-40079	29 Jun 202615:32	–	euvd
NVD	CVE-2026-40524	29 Jun 202614:16	–	nvd
Positive Technologies	PT-2026-53271	29 Jun 202600:00	–	ptsecurity

Vulners

Node

frontaccounting frontaccountingRange0–2.4.20

[
  {
    "defaultStatus": "affected",
    "vendor": "FrontAccounting",
    "product": "FrontAccounting",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThan": "2.4.20"
      },
      {
        "status": "unaffected",
        "version": "647a18196caad27f96ea852e993c9e30f815357f",
        "versionType": "git"
      }
    ]
  }
]

Source	Link
jivasecurity	www.jivasecurity.com/writeups/frontaccounting-sqli-journal-entries-report-cve-2026-40524
sourceforge	www.sourceforge.net/p/frontaccounting/news/2026/04/release-2420/
github	www.github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f
vulncheck	www.vulncheck.com/advisories/frontaccounting-sql-injection-via-get-gl-transactions

29 Jun 2026 14:16Current

6Medium risk

Vulners AI Score6

CVSS 47.2

CVSS 3.18.1

CWE-89