High severityNVD Advisory· Published Nov 12, 2026
CVE-2026-118597
CVE-2026-118597
Description
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- fluidattacks.com/advisories/rhiannonnvd
- github.com/akaunting/akaunting/blob/3.3.0/app/Abstracts/Http/SettingController.phpnvd
- github.com/akaunting/akaunting/blob/3.3.0/app/View/Components/Form/Group/PaymentTerm.phpnvd
- github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/group/payment_term.blade.phpnvd
News mentions
0No linked articles in our index yet.