The vulnerability stems from insufficient validation of the notes argument in Akaunting’s Invoice/Billing module. A malicious payload injected into this field is rendered directly in the browser, allowing an attacker to execute arbitrary JavaScript. This is a classic reflected XSS scenario (CWE‑79) and, because executable code can be inserted, it also maps to CWE‑94. If an attacker can deliver a crafted request, the injected script can hijack sessions, steal credentials, or alter page content, potentially compromising data confidentiality and integrity.

Akaunting versions up to and including 3.1.21 are affected; no further version details are available.

The CVSS score of 5.1 classifies this issue as medium severity. The lack of an EPSS score and KEV listing suggests no confirmed large‑scale exploitation; however, exploitation is feasible remotely by sending a crafted HTTP request containing malicious content in the notes field. Based on the description, it is unclear whether unauthenticated users or only users with write access to invoices can exploit this flaw.