Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck

CVE-2026-40522FrontAccounting < 2.4.20 SQL Injection via rep601.php

High 7.1

In plain English

A high-severity SQL injection in FrontAccounting from FrontAccounting. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 85.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.

Affected products (as reported)

Vendor	Product	Versions
FrontAccounting	FrontAccounting	0 – before 2.4.20

Weakness: CWE-89, CWE-916 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://jivasecurity.com/writeups/frontaccounting-sqli-bank-statement-report-cve-2026-40522 technical-description, exploit
https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/ release-notes
https://github.com/FrontAccountingERP/FA/commit/894adaf71393e0ef6a04fe6036fcd2464050f590 patch
https://www.vulncheck.com/advisories/frontaccounting-sql-injection-via-rep601-php third-party-advisory