PT-2026-30437 · Akaunting · Akaunting

Gabriel · Published 2026-04-05 · Updated 2026-04-05 · CVE-2026-5568

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Akaunting versions up to 3.1.21

Description Akaunting software is affected by a cross site scripting issue in the Invoice/Billing component. Manipulation of the notes argument can lead to exploitation. The issue is potentially exploitable remotely, and the exploit has been publicly disclosed. The vendor was contacted but did not respond.

Recommendations Update Akaunting to a version later than 3.1.21.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-5568

Affected Products

Akaunting

References · 8

• 🔥 https://docs.google.com/document/d/1TFwYGdjDblEGCMM0l67PXz0HXZu_iUqWDQZavtM9t1U/edit?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5568 · Security Note
• https://twitter.com/CVEnew/status/2040780258299773413 · Twitter Post
• https://vuldb.com/vuln/355338/cti · Note
• https://vuldb.com/submit/783139 · Note
• https://twitter.com/cyberbivash/status/2040802517374718313 · Twitter Post
• https://vuldb.com/vuln/355338 · Note
• https://twitter.com/infoflowcloud/status/2040780406715195540 · Twitter Post