CVE-2026-80211 | Medium | 5.9 | 2026-08-27 | FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and upd… |
CVE-2026-80210 | Medium | 6.5 | 2026-08-27 | FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it re… |
CVE-2026-40524 | High | 8.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated dire… |
CVE-2026-40523 | High | 8.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC p… |
CVE-2026-40522 | High | 7.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitr… |
CVE-2026-40521 | High | 8.8 | 2026-06-29 | FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary… |
CVE-2014-125080 | Medium | 5.5 | 2023-01-16 | A vulnerability has been found in frontaccounting faplanet and classified as critical. This vulnerability affects unknown code. The manipulation leads to path… |
CVE-2020-21244 | Medium | 4.9 | 2020-09-30 | An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via admin/inst_lang.php. |
CVE-2019-5720 | Critical | 9.8 | 2019-01-08 | includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab th… |
CVE-2018-1000890 | High | 7.5 | 2018-12-28 | FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to… |
CVE-2018-7176 | High | 8.8 | 2018-02-16 | FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions pa… |
CVE-2014-3973 | | | 2014-06-05 | Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. |
CVE-2011-3740 | | | 2011-09-23 | FrontAccounting 2.3.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an er… |
CVE-2009-4046 | | | 2009-11-20 | Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified par… |
CVE-2009-4045 | | | 2009-11-20 | Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via unspecified parameters… |
CVE-2009-4037 | | | 2009-11-20 | Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x before 2.2 RC, allow remote attackers to execute arbitrary SQL commands… |
CVE-2007-5148 | | | 2007-10-01 | Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.12 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_r… |
CVE-2007-5117 | | | 2007-09-27 | Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow remote attackers to execute arbitrary… |
CVE-2007-4279 | | | 2007-08-09 | PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31 allows remote attackers to execute arbitrary PHP code via a URL in the p… |