Is there a public PoC exploit available for CVE-2026-5568?

Yes, a public proof-of-concept exploit is available for CVE-2026-5568. Prioritise patching immediately. EPSS: 0.0%.

Akaunting CVE-2026-5568

Q: What is the CVSS score of CVE-2026-5568?

CVE-2026-5568 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19083 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-05 VulDB

XSS Akaunting

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 13:15 euvd

EUVD-2026-19083

Analysis Generated

Apr 05, 2026 - 13:15 vuln.today

CVE Published

Apr 05, 2026 - 13:00 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability has been found in Akaunting up to 3.1.21. This issue affects some unknown processing of the component Invoice/Billing. The manipulation of the argument notes leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site scripting (XSS) in Akaunting up to version 3.1.21 allows authenticated users to inject malicious scripts via the notes parameter in the Invoice/Billing component, potentially compromising other users' sessions when they view affected invoices. The vulnerability requires user interaction (UI:P) to trigger and has publicly available exploit code; however, vendor remediation response is unknown.

Technical ContextAI

The vulnerability is a reflected or stored XSS flaw (CWE-79) in Akaunting's Invoice/Billing processing module, specifically in how the notes parameter is handled without sufficient input sanitization or output encoding. Akaunting is an open-source accounting and invoicing platform written in PHP/Laravel. The notes field accepts user input that is rendered in the web interface without proper HTML entity encoding or Content Security Policy protections, allowing attackers to embed JavaScript that executes in the context of other authenticated users' browsers. This is a classic unsafe data flow where user-controlled input flows directly to HTML rendering without validation.

RemediationAI

Upgrade Akaunting to a patched version released after this disclosure if available from the Akaunting project repository or official releases. If no patched version is available, implement immediate compensating controls: restrict authentication access to trusted users only, implement input validation on the notes field to reject HTML/JavaScript characters, apply output encoding (HTML entity encoding) to all invoice notes displayed in the web interface, and deploy a Web Application Firewall with XSS detection rules targeting the notes parameter. Review the public exploit documentation at https://docs.google.com/document/d/1TFwYGdjDblEGCMM0l67PXz0HXZu_iUqWDQZavtM9t1U/edit?usp=sharing to understand attack vectors. Contact Akaunting maintainers or consider switching to actively maintained accounting software if security updates are unavailable.