CVE-2021-36800 Akaunting OS Command Injection in 'Money.php'

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /companyid/sales/invoices/invoiceid with an items0price that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the...

CVE-2021-36800

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /companyid/sales/invoices/invoiceid with an items0price that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the...

CVE-2021-36805: Improper Neutralization of Input During Web Page Generation

Akaunting version 2.1.12 and earlier suffers from a persistent type II cross-site scripting XSS vulnerability in the sales invoice processing component of the application. This issue was fixed in version 2.1.13 of the product...

PT-2021-21368

Name of the Vulnerable Software and Affected Versions Akaunting versions 2.1.12 and earlier Description The issue is an authentication bypass problem in a user-controllable field, specifically companies0. This problem was resolved in version 2.1.13 of the product. Recommendations For versions...

PT-2021-21371

Name of the Vulnerable Software and Affected Versions Akaunting versions 2.1.12 and earlier Description The issue allows an attacker to proxy password reset requests through a running Akaunting instance if the attacker knows the target's e-mail address. This is caused by the defaults provided by...

CVE-2021-36801: Authorization Bypass Through User-Controlled Key

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies0. This issue was fixed in version 2.1.13 of the product...

Akaunting authorization issue vulnerability

Akaunting is an application from Akaunting that provides all the tools you need to manage your money online. An authorization issue vulnerability exists in Akaunting versions 2.1.12 and earlier. An attacker can proxy a password reset request through a running instance of Akaunting if the attacker...

Akaunting cross-site scripting vulnerabilities

Akaunting is a free, open source online accounting software designed for small businesses and freelancers. akaunting 2.1.12 and earlier versions contain a persistent cross-site scripting vulnerability when processing user-supplied avatar images. An attacker could exploit the vulnerability to inse...

CVE-2021-36803: Improper Neutralization of Input During Web Page Generation

Akaunting version 2.1.12 and earlier suffers from a persistent type II cross-site scripting XSS vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product...

PT-2021-21370

Name of the Vulnerable Software and Affected Versions Akaunting versions 2.1.12 and earlier Description The issue is a persistent type II cross-site scripting XSS vulnerability that occurs when processing user-supplied avatar images. This vulnerability was fixed in version 2.1.13 of the product...

Akaunting cross-site scripting vulnerabilities

Akaunting is an application from Akaunting that provides all the tools you need to manage your money online. A security vulnerability exists in Akaunting version 2.1.12 and earlier. The issue has been fixed in version 2.1.13...

CVE-2021-36804: Weak Password Recovery Mechanism for Forgotten Password

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please...

CVE-2021-36802: Uncaught Exception

Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product...

PT-2021-21369

Name of the Vulnerable Software and Affected Versions Akaunting versions 2.1.12 and earlier Description The issue is a denial-of-service problem triggered by setting a malformed locale variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the...

Akaunting security vulnerabilities

Akaunting is a free, open source online accounting software designed for small businesses and freelancers.An authentication bypass vulnerability exists in the user-controllable field companies0 in Akaunting 2.1.12 and earlier versions. No detailed vulnerability details are currently available...

Akaunting security vulnerabilities

Akaunting is an application from Akaunting that provides all the tools you need to manage your money online. A security vulnerability exists in Akaunting. The vulnerability stems from setting a misformatted locale variable and sending it in an otherwise normal HTTP POST request, which can lead to...

PT-2021-21372

Name of the Vulnerable Software and Affected Versions Akaunting versions 2.1.12 and earlier Description The issue is a persistent type II cross-site scripting XSS vulnerability in the sales invoice processing component of the application. This vulnerability was fixed in version 2.1.13 of the...

Akaunting code injection vulnerability

Akaunting is an application from Akaunting that provides all the tools needed to manage money online. A code injection vulnerability exists in Akaunting version 2.1.12 and earlier, which stems from the inclusion of a PHP callable function for items0price in the Money.php component of the...

CVE-2021-36800: Improper Control of Generation of Code

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /companyid/sales/invoices/invoiceid with an items0price that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the...

Multiple Open Source Web App Vulnerabilities Fixed

Today, Rapid7 is disclosing 9 vulnerabilities that affect 3 open-source projects: EspoCRM, Pimcore, and Akaunting. Right out of the gate, I'd like to give a special thanks to these 3 open-source project maintainers. While it's never great to learn of new vulnerabilities in your own product, all 3...