Akaunting is a small, modestly deployed open-source accounting and invoicing platform that occupies a focused but growing footprint in the small-business finance software landscape. Its vulnerabilities skew toward serious outcomes and include a meaningful tendency toward public exploit availability, clustering in input-handling and authorization weaknesses such as cross-site scripting, code injection, OS command injection, and authorization bypass that are characteristic of web application attack surfaces. Defenders deploying this platform should prioritize patching and restrict administrative access; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Akaunting over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-22836CRITICAL An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the | Feb 8, 2024 | 9.8 | 54 | NO | YES |
CVE-2021-36800CRITICAL Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invoices/{invoice_id} wit | Aug 4, 2021 | 9.1 | 28 | NO | NO |
CVE-2021-36804HIGH Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instanc | Aug 4, 2021 | 8.1 | 26 | NO | NO |
CVE-2021-36801HIGH Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product | Aug 4, 2021 | 8.1 | 25 | NO | NO |
CVE-2025-55522MEDIUM Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted pay | Aug 21, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-55521MEDIUM An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via a crafted POST request. | Aug 21, 2025 | 6.5 | 22 | NO | NO |
CVE-2020-22390HIGH Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution wh | Jun 21, 2021 | 8.8 | 22 | NO | NO |
CVE-2021-36802MEDIUM Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP PO | Aug 4, 2021 | 6.5 | 21 | NO | NO |
CVE-2020-20908MEDIUM Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload | Oct 25, 2021 | 5.4 | 20 | NO | NO |
CVE-2021-36803MEDIUM Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in | Aug 4, 2021 | 5.4 | 19 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Akaunting.
Media articles that mention a CVE ID that affects a product developed by Akaunting — matched by CVE ID, not by vendor name.