CVE-2025-55522

MEDIUM

Akaunting 3.0.4-3.1.18 - Stored Cross-Site Scripting via Name Parameter in Reports Component

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0038
EPSS Percentile 30.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
akaunting/akaunting 3.0.4 - 3.1.19
Published Aug 21, 2025
Tracked Since Feb 18, 2026