Frontaccounting

Frontaccounting

12 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.5

CVE-2020-21244

Exploit
  • EPSS 0.52%
  • Veröffentlicht 30.09.2020 18:15:23
  • Zuletzt bearbeitet 21.11.2024 05:12:29

An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via admin/inst_lang.php.

9.8

CVE-2019-5720

Exploit
  • EPSS 0.28%
  • Veröffentlicht 08.01.2019 10:29:00
  • Zuletzt bearbeitet 21.11.2024 04:45:23

includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of the application via the void_transaction.php filterType parameter.

7.5

CVE-2018-1000890

Exploit
  • EPSS 0.6%
  • Veröffentlicht 28.12.2018 16:29:02
  • Zuletzt bearbeitet 21.11.2024 03:40:36

FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application.

8.8

CVE-2018-7176

Exploit
  • EPSS 0.18%
  • Veröffentlicht 16.02.2018 04:29:00
  • Zuletzt bearbeitet 21.11.2024 04:11:43

FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page).

7.5

CVE-2014-3973

Exploit
  • EPSS 0.42%
  • Veröffentlicht 05.06.2014 17:55:07
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

5

CVE-2011-3740

Exploit
  • EPSS 0.28%
  • Veröffentlicht 23.09.2011 23:55:03
  • Zuletzt bearbeitet 11.04.2025 00:51:21

FrontAccounting 2.3.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by reporting/includes/fpdi/fpdi2tcpdf_bridge.php and certain o...

7.5

CVE-2009-4045

  • EPSS 0.4%
  • Veröffentlicht 20.11.2009 19:30:01
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to various .inc and .php files in (1) reporting/, (2) sales/, (3) sales/includes/, (4) sal...

7.5

CVE-2009-4046

  • EPSS 0.41%
  • Veröffentlicht 20.11.2009 19:30:01
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_accoun...

7.5

CVE-2009-4037

  • EPSS 0.71%
  • Veröffentlicht 20.11.2009 19:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x before 2.2 RC, allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) admin/db/users_db.inc, and various other .inc and .php fi...

6.8

CVE-2007-5148

  • EPSS 0.65%
  • Veröffentlicht 01.10.2007 05:17:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.12 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter to (1) access/logout.php or certain PHP scripts under (2) admin/, (3) dimensi...