CVE-2026-40523: Frontaccounting

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and PARAM_3 POST parameters. Attackers can exploit time-based blind SQL injection through SLEEP() functions that are amplified across JOIN result sets to cause denial of service by exhausting database connections, or extract arbitrary database content through UNION-based injection techniques.

Affected products

• Frontaccounting Frontaccounting: before 2.4.20 (fixed in 2.4.20)

Published 2026-06-29. Last modified 2026-06-29.