CVE-2026-118597

Akaunting version 3.3.0 is susceptible to a stored cross-site scripting (XSS) vulnerability within the custom invoice payment terms feature. The root cause is the improper handling of user-supplied values, where an authenticated Manager can save a crafted payment-term value. When another authoriz...