https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-21244.htmlhttps://patchthecve.com/cve/CVE-2020-21244.htmlWed, 17 Jun 2026 03:03:36 +0000MEDIUM 4.9: An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via admin/inst_lang.php.https://patchthecve.com/cve/CVE-2019-5720.htmlhttps://patchthecve.com/cve/CVE-2019-5720.htmlWed, 17 Jun 2026 02:38:06 +0000CRITICAL 9.8: includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of the application via the void_transaction.php filterType parameter.https://patchthecve.com/cve/CVE-2018-1000890.htmlhttps://patchthecve.com/cve/CVE-2018-1000890.htmlWed, 17 Jun 2026 01:33:16 +0000HIGH 7.5: FrontAccounting 2.4.5 contains a Time Based Blind SQL Injection vulnerability in the parameter "filterType" in /attachments.php that can allow the attacker to grab the entire database of the application.https://patchthecve.com/cve/CVE-2018-7176.htmlhttps://patchthecve.com/cve/CVE-2018-7176.htmlWed, 17 Jun 2026 02:02:44 +0000HIGH 8.8: FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page).