Spoofing

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please...

Code injection

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /companyid/sales/invoices/invoiceid with an items0price that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the...

Cross site request forgery (csrf)

Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product...

Cross site scripting

Akaunting version 2.1.12 and earlier suffers from a persistent type II cross-site scripting XSS vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product...

Authentication flaw

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies0. This issue was fixed in version 2.1.13 of the product...

Cross site scripting

Akaunting version 2.1.12 and earlier suffers from a persistent type II cross-site scripting XSS vulnerability in the sales invoice processing component of the application. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36805

CVE-2021-36805 refers to Akaunting v2.1.12 and earlier, with a persistent (type II) cross-site scripting (XSS) vulnerability in the invoice footer processing during sales invoices. The issue originates from HTML/footer handling that bypasses built‑in firewall filtering, enabling injected JavaScri...

CVE-2021-36805 Akaunting Invoice Footer Persistent XSS

Akaunting version 2.1.12 and earlier suffers from a persistent type II cross-site scripting XSS vulnerability in the sales invoice processing component of the application. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36804

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please...

CVE-2021-36804

CVE-2021-36804 (Akaunting) affects Akaunting

CVE-2021-36804 Akaunting Password Reset Relay

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please...

CVE-2021-36803 Akaunting Avatar Persistent XSS

Akaunting version 2.1.12 and earlier suffers from a persistent type II cross-site scripting XSS vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36803

CVE-2021-36803 affects Akaunting 2.1.12 and earlier; it is a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. The underlying issue is that avatar upload content is rendered, allowing injected HTML/JS to execute when an avatar is viewed. Seve...

CVE-2021-36802

Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36802

CVE-2021-36802 - Akaunting : A DoS flaw in Akaunting up to version 2.1.12 (and earlier) is triggered by a malformed 'locale' value in a normal HTTP POST request. The issue is fixed in version 2.1.13. Impact is denial of service with partial availability loss; no other impacts are stated. Remediat...

CVE-2021-36802 Akaunting DoS via User-Controlled 'locale' Variable

Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36801 Akaunting Authentication Bypass in Company Selection

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies0. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36801

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies0. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36801

CVE-2021-36801 affects Akaunting v2.1.12 and earlier, where an authentication bypass in the user-controllable field companies[0] allows access/operations across different companies. The vulnerability is fixed in v2.1.13. Severity is high (CVSSv3.1 base score 8.1; CVSSv2 base 5.5). Multiple source...

CVE-2021-36800 Akaunting OS Command Injection in 'Money.php'

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /companyid/sales/invoices/invoiceid with an items0price that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the...