| शीर्षक | Akaunting v3.1.21 Cross Site Scripting |
|---|
| विवरण | A Stored Cross-Site Scripting (XSS) vulnerability was identified in Akaunting v3.1.21, an open-source accounting application. The vulnerability exists in the notes field of invoice and bill documents. When a user holding at least a Manager-level role (both Manager and Admin roles hold the create-sales-invoices permission; Accountant and Customer roles do not) creates an invoice containing an HTML/JavaScript payload in the Notes field, the payload is stored in the database without sanitization and later rendered unescaped in the browser of any user who views the document. This satisfies the criteria for a Stored (Persistent) XSS attack.
https://github.com/akaunting/akaunting |
|---|
| स्रोत | ⚠️ https://docs.google.com/document/d/1TFwYGdjDblEGCMM0l67PXz0HXZu_iUqWDQZavtM9t1U/edit?usp=sharing |
|---|
| उपयोगकर्ता | gabriel (UID 72007) |
|---|
| सबमिशन | 19/03/2026 08:05 PM (7 महीनों पहले) |
|---|
| संयम | 04/04/2026 04:29 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355338 [Akaunting तक 3.1.21 Invoice/Billing notes क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|