CVE-2026-11943

MediumCVSS 4.8

Published: 22/06/2026(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile — higher than 17% of all known CVEs

Summary

Akaunting version 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their profile name.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to update Akaunting to the latest version to mitigate this vulnerability and review user profile editing capabilities.

Original NVD description (English source)

Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their own profile name.