CVE-2021-36803 Akaunting Avatar Persistent XSS

Akaunting version 2.1.12 and earlier suffers from a persistent type II cross-site scripting XSS vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36803

CVE-2021-36803 affects Akaunting 2.1.12 and earlier; it is a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. The underlying issue is that avatar upload content is rendered, allowing injected HTML/JS to execute when an avatar is viewed. Seve...

CVE-2021-36802

CVE-2021-36802 - Akaunting : A DoS flaw in Akaunting up to version 2.1.12 (and earlier) is triggered by a malformed 'locale' value in a normal HTTP POST request. The issue is fixed in version 2.1.13. Impact is denial of service with partial availability loss; no other impacts are stated. Remediat...

CVE-2021-36802 Akaunting DoS via User-Controlled 'locale' Variable

Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36801 Akaunting Authentication Bypass in Company Selection

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies0. This issue was fixed in version 2.1.13 of the product...

CVE-2021-36801

CVE-2021-36801 affects Akaunting v2.1.12 and earlier, where an authentication bypass in the user-controllable field companies[0] allows access/operations across different companies. The vulnerability is fixed in v2.1.13. Severity is high (CVSSv3.1 base score 8.1; CVSSv2 base 5.5). Multiple source...

CVE-2021-36800 Akaunting OS Command Injection in 'Money.php'

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /companyid/sales/invoices/invoiceid with an items0price that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the...

CVE-2021-36800

CVE-2021-36800 affects Akaunting v2.1.12 and earlier. A code-injection flaw in Money.php allows a crafted POST to /{company_id}/sales/invoices/{invoice_id} with items[0][price] containing a PHP callable to be executed on the server. Root cause: lack of input sanitization in Money.php, with parseA...

Akaunting 安全漏洞

Akaunting is a free, open source online accounting software designed for small businesses and freelancers.An authentication bypass vulnerability exists in the user-controllable field companies0 in Akaunting 2.1.12 and earlier versions. No detailed vulnerability details are currently available...

Akaunting 跨站脚本漏洞

Akaunting is an application from Akaunting that provides all the tools you need to manage your money online. A security vulnerability exists in Akaunting version 2.1.12 and earlier. The issue has been fixed in version 2.1.13...

Akaunting 代码注入漏洞

Akaunting is an application from Akaunting that provides all the tools needed to manage money online. A code injection vulnerability exists in Akaunting version 2.1.12 and earlier, which stems from the inclusion of a PHP callable function for items0price in the Money.php component of the...

Akaunting 安全漏洞

Akaunting is an application from Akaunting that provides all the tools you need to manage your money online. A security vulnerability exists in Akaunting. The vulnerability stems from setting a misformatted locale variable and sending it in an otherwise normal HTTP POST request, which can lead to...

Akaunting 授权问题漏洞

Akaunting is an application from Akaunting that provides all the tools you need to manage your money online. An authorization issue vulnerability exists in Akaunting versions 2.1.12 and earlier. An attacker can proxy a password reset request through a running instance of Akaunting if the attacker...

Akaunting 跨站脚本漏洞

Akaunting is a free, open source online accounting software designed for small businesses and freelancers. akaunting 2.1.12 and earlier versions contain a persistent cross-site scripting vulnerability when processing user-supplied avatar images. An attacker could exploit the vulnerability to inse...

Multiple Open Source Web App Vulnerabilities Fixed

Today, Rapid7 is disclosing 9 vulnerabilities that affect 3 open-source projects: EspoCRM, Pimcore, and Akaunting. Right out of the gate, I'd like to give a special thanks to these 3 open-source project maintainers. While it's never great to learn of new vulnerabilities in your own product, all 3...

CVE-2021-36800

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /companyid/sales/invoices/invoiceid with an items0price that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the...

CVE-2021-36801

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies0. This issue was fixed in version 2.1.13 of the product...

Several Bugs Found in 3 Open-Source Software Used by Several Businesses

Cybersecurity researchers on Tuesday disclosed nine security vulnerabilities affecting three open-source projects — EspoCRM, Pimcore, and Akaunting — that are widely used by several small to medium businesses and, if successfully exploited, could provide a pathway to more sophisticated attacks. A...

CSV Injection

akaunting is vulnerable to CSV Injection. An attacker is able to inject malicious crafted file and execute arbitrary code into the name parameter...

Akaunting CSV Injection Vulnerability

Akaunting is a free, open source online accounting software designed for small businesses and freelancers. A CSV injection vulnerability exists in the project name field of the export function in Akaunting. An attacker can exploit this vulnerability to inject arbitrary code into the name paramete...