CVE-2026-11994
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk24th percentile — higher than 24% of all known CVEs
Summary
Akaunting version 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious code, potentially leading to user data theft or session hijacking. This poses a serious threat to the application's security and user data.
Recommendation
It is recommended to upgrade to the latest version of Akaunting to mitigate this vulnerability. Additionally, implementing validation and sanitization of user input in the report description field is advisable.
Original NVD description (English source)
Akaunting 3.1.21 contains an authenticated stored Cross-Site Scripting vulnerability in the report management workflow. A user with permission to create or update reports can store arbitrary HTML/JavaScript in the description field of a report.