PT-2026-53269 · Frontaccounting · Frontaccounting

Jiva · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-40522

NVD

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM 0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-916

CWE-89

Related Identifiers

CVE-2026-40522

Affected Products

Frontaccounting

References · 5

• 🔥 https://jivasecurity.com/writeups/frontaccounting-sqli-bank-statement-report-cve-2026-40522 · Exploit
• https://github.com/FrontAccountingERP/FA/commit/894adaf71393e0ef6a04fe6036fcd2464050f590 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40522 · Security Note
• https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420 · Note
• https://vulncheck.com/advisories/frontaccounting-sql-injection-via-rep601-php · Note