CVE-2021-36800

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invoices/{invoice_id} with an items[0][price] that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the product.

• CWE-94
• CWE-94

• https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/Exploit, Third Party Advisory
• https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/Exploit, Third Party Advisory

Published

Aug 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36794In Siren Investigate before 11.1.4, when enabling the cluste…9.8
• CVE-2021-36795A permission issue in the Cohesity Linux agent may allow pri…7.8
• CVE-2021-36797In Victron Energy Venus OS through 2.72, root access is gran…6.8
• CVE-2021-36798A Denial-of-Service (DoS) vulnerability was discovered in Te…7.5
• CVE-2021-36799KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Pass…8.8
• CVE-2021-3680showdoc is vulnerable to Missing Cryptographic Step4.9
• CVE-2021-36801Akaunting version 2.1.12 and earlier suffers from an authent…8.1
• CVE-2021-36802Akaunting version 2.1.12 and earlier suffers from a denial-o…6.5
• CVE-2021-36803Akaunting version 2.1.12 and earlier suffers from a persiste…5.4
• CVE-2021-36804Akaunting version 2.1.12 and earlier suffers from a password…8.1
• CVE-2021-36805Akaunting version 2.1.12 and earlier suffers from a persiste…4.8
• CVE-2021-36806 A reflected XSS vulnerability allows an open redirect when …6.1