Frontaccounting is a modestly represented open-source web-based accounting and enterprise resource planning application that, despite a narrow product scope, occupies a prominent position among small-to-medium business financial software. Its vulnerability exposure skews toward a meaningful share of serious-severity outcomes and frequently acquires public exploit code, concentrating on application-layer input-handling weaknesses including SQL injection, code injection, cross-site request forgery, path traversal, and sensitive information exposure that are endemic to web-facing financial platforms. Defenders should track this vendor's releases closely given the sensitivity of accounting data and the direct reach of its application to customer-facing web interfaces; live severity, exploitation, and coverage details are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Frontaccounting over time
Signals from CVEs in this vendor scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-4279HIGH PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter | Aug 9, 2007 | 7.5 | 71 | NO | YES |
CVE-2026-40524HIGH FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() | Jun 29, 2026 | 8.1 | 36 | NO | NO |
CVE-2026-40523HIGH FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute | Jun 29, 2026 | 8.1 | 36 | NO | NO |
CVE-2026-40521HIGH FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading fi | Jun 29, 2026 | 8.8 | 36 | NO | NO |
CVE-2018-7176HIGH FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page). | Feb 16, 2018 | 8.8 | 35 | NO | YES |
CVE-2007-5117HIGH Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in | Sep 27, 2007 | 9.3 | 34 | NO | YES |
CVE-2026-40522HIGH FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by | Jun 29, 2026 | 7.1 | 31 | NO | NO |
CVE-2019-5720CRITICAL includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of | Jan 8, 2019 | 9.8 | 31 | NO | NO |
CVE-2018-1000890HIGH FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire datab | Dec 28, 2018 | 7.5 | 26 | NO | NO |
CVE-2009-4046HIGH Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_a | Nov 20, 2009 | 7.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (16 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Frontaccounting.
Media articles that mention a CVE ID that affects a product developed by Frontaccounting — matched by CVE ID, not by vendor name.