CVE-2026-11942
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk17th percentile — higher than 17% of all known CVEs
Summary
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious code, potentially leading to data theft or session hijacking. This poses a significant threat to the application's security and user data.
Recommendation
It is recommended to upgrade to the latest version of Akaunting to mitigate this vulnerability. Additionally, implementing input validation and sanitization can help minimize the risk of XSS attacks.
Original NVD description (English source)
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.