CVE-2026-118855
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 12, 2026
Vendor
unknown
Description
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.