CVE-2026-5568
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A cross-site scripting vulnerability was found in Akaunting up to version 3.1.21 in the Invoice/Billing component via the notes argument. Remote attack is possible. Exploit is publicly available. The vendor did not respond.
Risk Assessment
An attacker can inject malicious scripts, leading to data theft or session hijacking.
Recommendation
Contact the vendor for a patch or apply temporary input filtering.
Original NVD description (English source)
A vulnerability has been found in Akaunting up to 3.1.21. This issue affects some unknown processing of the component Invoice/Billing. The manipulation of the argument notes leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.