CVE-2026-40522

Name of the Vulnerable Software and Affected Versions FrontAccounting versions prior to 2.4.20

Description An issue exists in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data. By injecting UNION SELECT payloads into the PARAM 0 POST parameter, attackers can use malicious SQL syntax through an unparameterized WHERE clause to retrieve sensitive information, such as usernames, password hashes, and email addresses from the users table, which is then rendered in the PDF report output. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to database data.

Recommendations Update FrontAccounting to version 2.4.20 or later.