Frontaccounting

Frontaccounting

16 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2026-40521

Exploit
  • EPSS 0.63%
  • Veröffentlicht 29.06.2026 12:30:12
  • Zuletzt bearbeitet 30.06.2026 14:16:26

FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers c...

7.1

CVE-2026-40522

Exploit
  • EPSS 0.15%
  • Veröffentlicht 29.06.2026 12:29:40
  • Zuletzt bearbeitet 29.06.2026 19:15:23

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attac...

8.1

CVE-2026-40523

Exploit
  • EPSS 0.28%
  • Veröffentlicht 29.06.2026 12:29:10
  • Zuletzt bearbeitet 29.06.2026 19:15:23

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and...

8.1

CVE-2026-40524

Exploit
  • EPSS 0.28%
  • Veröffentlicht 29.06.2026 12:27:26
  • Zuletzt bearbeitet 01.07.2026 15:17:07

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permissi...

5.5

CVE-2020-21244

Exploit
  • EPSS 1.01%
  • Veröffentlicht 30.09.2020 18:15:23
  • Zuletzt bearbeitet 21.11.2024 05:12:29

An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via admin/inst_lang.php.

9.8

CVE-2019-5720

Exploit
  • EPSS 1.54%
  • Veröffentlicht 08.01.2019 10:29:00
  • Zuletzt bearbeitet 21.11.2024 04:45:23

includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of the application via the void_transaction.php filterType parameter.

7.5

CVE-2018-1000890

Exploit
  • EPSS 1.78%
  • Veröffentlicht 28.12.2018 16:29:02
  • Zuletzt bearbeitet 21.11.2024 03:40:36

FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application.

8.8

CVE-2018-7176

Exploit
  • EPSS 2.35%
  • Veröffentlicht 16.02.2018 04:29:00
  • Zuletzt bearbeitet 21.11.2024 04:11:43

FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page).

7.5

CVE-2014-3973

Exploit
  • EPSS 1.35%
  • Veröffentlicht 05.06.2014 17:55:07
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

5

CVE-2011-3740

Exploit
  • EPSS 1.37%
  • Veröffentlicht 23.09.2011 23:55:03
  • Zuletzt bearbeitet 16.06.2026 23:33:50

FrontAccounting 2.3.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by reporting/includes/fpdi/fpdi2tcpdf_bridge.php and certain o...