Vulnerability record/PUBLISHED/Published Nov 12, 2026 07:32:18 UTC
CVE-2026-118855
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.
Base score7.0/ 10
SeverityHighCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsPresentAT
Privileges requiredHighPR
User interactionActiveUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityLowSC
Subsequent system integrityLowSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityFluid Attacks
Last updatedNov 12, 2026 07:32:18 UTC
PublishedNov 12, 2026 07:32:18 UTC
ReservedOct 28, 2026 22:43:53 UTC
Credits
- Fluid Attacks' AI SAST Scanner
- Miguel Gómez