FrontAccounting vulnerabilities
We track 4 vulnerabilities in FrontAccounting products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on June 29, 2026.
Latest FrontAccounting vulnerabilities
- 8.1 High severity
FrontAccounting: Improper Neutralization of Special Elements used in an SQL Command
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inj
- 8.1 High severity
FrontAccounting: Improper Neutralization of Special Elements used in an SQL Command
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and PARAM_3 P
- 7.1 High severity
FrontAccounting: Improper Neutralization of Special Elements used in an SQL Command
FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can s
- 8.8 High severity
FrontAccounting: Improper Limitation of a Pathname to a Restricted Directory
FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply