Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-11943

Akaunting 3.1.21 - Authenticated stored XSS in document timeline

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Fluid Attacks

Description

Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their own profile name.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Akaunting Akaunting

Default version status: unaffected

  • 3.1.21affected

References