GCVE - cpe:2.3:a:frontaccounting:frontaccounting:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:frontaccounting:frontaccounting:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Frontaccounting (`b68b6e7c-856b-5dbe-a774-3a1252e0f405`)
Product	Frontaccounting (`4c9212db-7c13-506d-a18e-765306302a2c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/apmuthu/frontaccounting`	purl2cpe	2026-06-01 10:11:21.645304
`pkg:github/frontaccountingerp/fa`	purl2cpe	2026-06-01 10:11:21.645306
`pkg:sourceforge/frontaccounting`	purl2cpe	2026-06-01 10:11:21.645307

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-40523`	vulnerable	2026-07-29 00:49:30.211634	FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php HIGH (8.1) FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and PARAM_3 POST parameters. Attackers can exploit time-based blind SQL injection through SLEEP() functions that are amplified across JOIN result sets to cause denial of service by exhausting database connections, or extract arbitrary database content through UNION-based injection techniques. Published: 2026-06-29T12:29:10.512Z Updated: 2026-07-14T20:00:35.704Z Open on db.gcve.eu Reference links https://jivasecurity.com/writeups/frontaccounting-sqli-audit-trail-report-cve-2026-40523 https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/ https://github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-reporting-rep710-php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-40522`	vulnerable	2026-07-29 00:49:30.211286	FrontAccounting < 2.4.20 SQL Injection via rep601.php HIGH (7.1) FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output. Published: 2026-06-29T12:29:40.825Z Updated: 2026-07-14T20:00:34.966Z Open on db.gcve.eu Reference links https://jivasecurity.com/writeups/frontaccounting-sqli-bank-statement-report-cve-2026-40522 https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/ https://github.com/FrontAccountingERP/FA/commit/894adaf71393e0ef6a04fe6036fcd2464050f590 https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-rep601-php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-40521`	vulnerable	2026-07-29 00:49:30.210942	FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload HIGH (8.8) FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PHP files without extension validation, achieve remote code execution as the web server user. Published: 2026-06-29T12:30:12.799Z Updated: 2026-07-14T20:00:34.255Z Open on db.gcve.eu Reference links https://jivasecurity.com/writeups/frontaccounting-rce-attachment-upload-cve-2026-40521 https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/ https://github.com/FrontAccountingERP/FA/commit/701fea6848da4a02fb83d30f07a9c0473d6b7e33 https://www.vulncheck.com/advisories/frontaccounting-path-traversal-rce-via-attachment-upload	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3973`	vulnerable	2026-06-08 05:05:43.726869	Details available Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Published: 2014-06-05T17:00:00.000Z Updated: 2024-09-17T04:20:41.629Z Open on db.gcve.eu Reference links http://frontaccounting.com/wb3/pages/posts/release-2.3.21201.php http://sourceforge.net/p/frontaccounting/mercurial/ci/7ab9e443a8eb9d1b03cbed33006b7665bda9383e http://secunia.com/advisories/58848	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4045`	vulnerable	2026-06-08 04:51:46.713232	Details available Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to various .inc and .php files in (1) reporting/, (2) sales/, (3) sales/includes/, (4) sales/includes/db/, (5) sales/inquiry/, (6) sales/manage/, (7) sales/view/, (8) taxes/, and (9) taxes/db/. Published: 2009-11-20T19:00:00.000Z Updated: 2024-09-16T19:34:58.108Z Open on db.gcve.eu Reference links http://secunia.com/advisories/37327 http://sourceforge.net/projects/frontaccounting/files/FrontAccounting-2/2.1.7/frontaccount-2.1.7.tar.gz/download http://frontaccounting.net/wb3/pages/posts/2.1.7-security-release103.php http://www.vupen.com/english/advisories/2009/3223	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4037`	vulnerable	2026-06-08 04:51:46.602248	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.