The vulnerable version of the accounting application stores an authenticated user’s profile name as raw HTML and displays it in the document timeline on invoice and bill detail pages. This allows that user to insert malicious JavaScript that is rendered each time the page is viewed. The injection is persistent and can lead to session hijacking, credential theft, defacement, and other integrity or confidentiality breaches inherent to a classic stored XSS flaw (CWE‑79).

The flaw is present only in Akaunting version 3.1.21 and is distributed for Linux, macOS, and Windows operating systems. Any installation of that release that displays a user’s profile name in an invoice or bill detail timeline is impacted. No other products or versions are listed as affected.

The CVSS score is 4.8, indicating a moderate severity. The EPSS score is not available, so the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account to set a malicious profile name; no higher privileges are needed. Once set, the malicious script executes in the browser context of any other user who views the invoice or bill detail page, representing a moderate risk of web‑session hijacking or defacement. The attack vector is inferred to be internal, relying on compromised or legitimate credentials.