CVE-2026-118368
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 11, 2026
Vendor
unknown
Description
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin.