CVE-2026-40522

FrontAccounting < 2.4.20 SQL Injection via rep601.php

State: Published
Severity: 7.1 High
Published: Jun 29, 2026
Updated: Jul 14, 2026
Reserved: Apr 13, 2026

Description

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	VulnCheck

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-916 Use of Password Hash With Insufficient Computational Effort

Affected Products

Product	Versions
FrontAccountingFrontAccounting	before 2.4.20Affected 894adaf71393e0ef6a04fe6036fcd2464050f590Not affected

References

https://jivasecurity.com/writeups/frontaccounting-sqli-bank-statement-report-cve-2026-40522technical-descriptionexploit
https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/release-notes
https://github.com/FrontAccountingERP/FA/commit/894adaf71393e0ef6a04fe6036fcd2464050f590patch
https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-rep601-phpthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.