FrontAccounting vulnerabilities
CVEs whose affected-version data names the FrontAccounting package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-80210Medium· 6.5FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php cal…
FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php cal…
▾ SunlitFrontAccounting · FrontAccountingEPSS 0.22%via NVD
CVE-2026-80211Medium· 5.9FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests
FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when…
▾ SunlitFrontAccounting · FrontAccountingEPSS 0.31%via NVD