EUVD-2021-1945

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

Akaunting versions 2.1.12 and earlier have a password reset spoofing vulnerability fixed in 2.1.13.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-36804	5 Aug 202103:23	–	circl
CNNVD	Akaunting 授权问题漏洞	4 Aug 202100:00	–	cnnvd
CVE	CVE-2021-36804	4 Aug 202122:20	–	cve
Cvelist	CVE-2021-36804 Akaunting Password Reset Relay	4 Aug 202122:20	–	cvelist
Github Security Blog	Malicious password-reset in Akaunting	1 Sep 202118:31	–	github
GitLab Advisory Database	Weak Password Recovery Mechanism for Forgotten Password	1 Sep 202100:00	–	gitlab
NVD	CVE-2021-36804	4 Aug 202123:15	–	nvd
OSV	GHSA-246R-R2WF-FRHX Malicious password-reset in Akaunting	1 Sep 202118:31	–	osv
Prion	Spoofing	4 Aug 202123:15	–	prion
Rapid7 Blog	Multiple Open Source Web App Vulnerabilities Fixed	27 Jul 202114:30	–	rapid7blog

[
  {
    "enisaIdVendor": [
      {
        "id": "ac5def37-606d-303f-959e-c78e57b93335",
        "vendor": {
          "name": "Akaunting"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "3222da3b-9367-3d94-88b0-799c684278cb",
        "product": {
          "name": "Akaunting"
        },
        "product_version": "2.1.12 ≤2.1.12"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-36804
github	www.github.com/laravel/laravel/pull/5477
github	www.github.com/laravel/laravel
github	www.github.com/laravel/laravel/blob/75a7dba9c44ce3555cc57dd1826467839fd9774f/CHANGELOG.md
laravel-enlightn	www.laravel-enlightn.com/docs/security/host-injection-analyzer.html
rapid7	www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed
rapid7	www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
github	www.github.com/advisories/GHSA-293c-r3p4-g63r

07 Oct 2025 00:30Current

8High risk

Vulners AI Score8

CVSS 3.15.4 - 8.1

CVSS 25.8

EPSS0.00325