CVE-2026-16772 | High | 8.1 | 2026-08-14 | In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administ… |
CVE-2026-71251 | Medium | 6.5 | 2026-08-05 | Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) f… |
CVE-2026-11994 | | | 2026-06-22 | Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or upd… |
CVE-2026-11943 | | | 2026-06-22 | Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authen… |
CVE-2026-11942 | | | 2026-06-22 | Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create… |
CVE-2024-58293 | | | 2025-12-11 | Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple fo… |
CVE-2025-55522 | Medium | 6.5 | 2025-08-21 | Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via in… |
CVE-2025-55521 | Medium | 6.5 | 2025-08-21 | An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via a crafted POST requ… |
CVE-2024-22836 | Critical | 9.8 | 2024-02-08 | An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute s… |
CVE-2020-20908 | Medium | 5.4 | 2021-10-25 | Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2021-36805 | Medium | 5.2 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the sales invoice processing component of… |
CVE-2021-36804 | Medium | 5.4 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a runn… |
CVE-2021-36803 | Medium | 6.3 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. Th… |
CVE-2021-36802 | Medium | 6.5 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an oth… |
CVE-2021-36801 | High | 8.1 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version… |
CVE-2021-36800 | High | 8.7 | 2021-08-04 | Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invo… |
CVE-2020-22390 | High | 8.8 | 2021-06-21 | Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perf… |