CVE-2026-40522
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.23%
- CWE
- CWE-89, CWE-916
- Published
- 2026-06-29
- Last modified
- 2026-07-14
Affected products
- FrontAccounting FrontAccounting
- FrontAccounting FrontAccounting
Weakness type
Related vulnerabilities
- CVE-2026-81800 — WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability
- CVE-2026-88890 — OpenPanel SQL Injection via unvalidated profile filter column identifier
- CVE-2026-9163 — SQLi in GIS Informatics' GisLab Laboratory Management System
- CVE-2026-78082 — Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4
- CVE-2026-7188 — SQLi in Armiya Information Technologies' Access Control System
- CVE-2026-87925 — Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection
- CVE-2026-87921 — Rizwan17 inventory-management-system manage.php update_record sql injection
- CVE-2026-79947 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...