{"schema_version":"1","data":[{"id":28587,"advisory_id":"7541a11b-0816-4d4b-abf3-c5e175744f2d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19198","source_published_at":"2026-08-19T18:58:01.093+00:00","published_at":"2026-10-25T07:45:04.452406+00:00","extraction_method":"structured","technologies":["akaunting","core-cve"],"cve_ids":["CVE-2026-19198"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch","summary":"Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.","evidence":"cve:CVE-2026-19198","products":[{"name":{"value":"Akaunting","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19198","aliases":["CVE-2026-19198"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","product":"Akaunting","versions":[{"status":"affected","version":"3.1.21"}],"platforms":["Windows","MacOS","Linux"],"defaultStatus":"unaffected"}],"modified":"2026-10-15T05:57:20.638Z","provider":"cve","references":["https://fluidattacks.com/advisories/badbo","https://github.com/akaunting/akaunting","https://github.com/akaunting/akaunting/commit/96c38008cf6f907e3e7341d9660de2912e0f2f13"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19198","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-19T19:30:07.346716Z"}}}],"references":[{"url":"https://fluidattacks.com/advisories/badbo","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-19T19:30:21.352Z"}}],"cna":{"orgId":"84fe0718-d6bb-4716-a7e8-81a6d1daa869","shortName":"Fluid Attacks","dateUpdated":"2026-10-15T05:57:20.638Z"}}},"related_cves":[{"value":"CVE-2026-19198","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3874,"advisory_id":"864f706e-7e80-43b5-9b45-0eaf58561f91","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-51019","source_published_at":"2026-09-29T16:04:16.077+00:00","published_at":"2026-10-24T21:42:41.488687+00:00","extraction_method":"structured","technologies":["akaunting","core-cve"],"cve_ids":["CVE-2022-51019"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Akaunting before 2.1.31 OS Command Injection via app alias","summary":"Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.","evidence":"cve:CVE-2022-51019","products":[{"name":{"value":"akaunting","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2022-51019","aliases":["CVE-2022-51019"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"akaunting","product":"akaunting","versions":[{"status":"affected","version":"0","lessThan":"2.1.31","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-29T17:29:16.797Z","provider":"cve","references":["https://github.com/akaunting/akaunting/commit/a1792327347a56ea575240b58673b2ece44230da","https://github.com/akaunting/akaunting/releases/tag/2.1.31","https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/InstallModule.php#L37-L39","https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/FinishUpdate.php#L45-L47","https://github.com/akaunting/akaunting","https://www.vulncheck.com/advisories/akaunting-before-2.1.31-os-command-injection-via-app-alias"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-51019","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T17:28:50.554827Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:29:16.797Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-29T16:04:16.077Z"}}},"related_cves":[{"value":"CVE-2022-51019","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":28587,"next_before":3874}