CVE-2026-40522

High

Description

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.

SeverityHigh

CVSS7.1

Exploit probability—

ProductFrontAccounting

PublishedJun 29, 2026

First seenJun 29, 2026

Weakness typeCWE-89SQL injection CWE-916CWE-916

How to fix

Update

FrontAccounting FrontAccounting2.4.20 or later

Patches

github.com/FrontAccountingERP/FA/commit/894adaf71393e0ef6a04fe6036fcd2464050f590

Vendor advisories

sourceforge.net/p/frontaccounting/news/2026/04/release-2420/

Affected products

Product	Affected versions	Fixed in
FrontAccounting FrontAccounting	v < 2.4.20	2.4.20

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.