CVE-2026-119275
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 12, 2026
Vendor
unknown
Description
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An authenticated Manager can import a child invoice whose invoice number contains HTML and is linked to a recurring invoice. When a victim opens that recurring invoice, Akaunting raw-renders the stored child number in an anchor, causing attacker-controlled markup to execute in the victim's browser.