Akaunting Cross-Site Scripting Vulnerability in Invoice Component

A stored cross-site scripting vulnerability has been identified in Akaunting versions through 3.1.21. The issue resides in the Invoice/Billing component, specifically within the notes field. When a user with a Manager-level role creates an invoice containing an unescaped HTML or JavaScript payload in the notes, the payload is stored in the database and later rendered in the browser of any user who views the document. This vulnerability allows for remote exploitation, requiring user interaction from the victim.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the invoice.