{"kind": "product", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "name": "facturascripts/facturascripts", "product": "facturascripts/facturascripts", "ecosystem": "Packagist", "items": [{"id": "GHSA-hgjx-r89m-m7v4", "noindex": false, "published": "2026-07-14T20:52:00Z", "modified": "2026-07-14T21:00:58.255347378Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-hgjx-r89m-m7v4", "title": "FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to   RCE", "description": "## Summary\n\n`FacturaScripts\\Core\\UploadedFile::move($destiny, $destinyName)` concatenates `$destiny` and `$destinyName` without normalizing the resulting path. Every caller in the codebase passes `UploadedFile::getClientOriginalName()` — the unsanitized client-supplied filename — as `$destinyName`, so an authenticated user submitting a filename containing `../` segments can write the uploaded content to any directory writable by the web-server user, escaping the intended `MyFiles/` location.\n\nBecause the shipped `htaccess-sample` (the documented production Apache configuration) excludes `Dinamic/Assets/` and `node_modules/` from the `index.ph", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-hgjx-r89m-m7v4", "https://github.com/NeoRazorX/facturascripts", "https://osv.dev/vulnerability/GHSA-hgjx-r89m-m7v4"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45710", "noindex": false, "published": "2026-07-14T17:30:26Z", "modified": "2026-07-28T05:30:29.715095251Z", "cvss": 3.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45710", "title": "FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`", "description": "## Summary\n\n`WidgetVariante::renderVariantList` (`Core/Lib/Widget/WidgetVariante.php:298-330`) and `WidgetSubcuenta::renderSubaccountList` (`Core/Lib/Widget/WidgetSubcuenta.php:290-321`) build the `<tr onclick=\"...\">` row for each modal hit by concatenating the user-controlled `referencia` / `codsubcuenta` field directly into a single-quoted JavaScript string literal inside an HTML `onclick` attribute. The defender's intuition is that `Tools::noHtml` (called in `Variante::test()` and `Subcuenta::test()`) replaces `'` with the HTML entity `&#39;`, neutralising the JavaScript string break. The intuition is wrong: HTML attribute parsing **decode", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3x7p-v8hj-xh5m", "https://github.com/NeoRazorX/facturascripts", "https://osv.dev/vulnerability/GHSA-3x7p-v8hj-xh5m"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45263", "noindex": false, "published": "2026-07-14T17:18:48Z", "modified": "2026-07-14T17:41:43.124669Z", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45263", "title": "FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export", "description": "## Summary\n\n> **Live PoC verified 2026-04-30** against a stock FacturaScripts master at `127.0.0.1:8081`. A low-privilege user (`lowpriv`) created a customer with `nombre = \"=SUM(1+1)*cmd|/c calc!A1\"`. An admin then exported `ListCliente` to CSV via `?action=export&option=CSV`. The downloaded file contains the raw payload as the first cell of the `nombre` column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as `=cmd|'/c calc'!A1` that spawn arbitrary processes on the admin workstation.\n\n`Core/Lib/Export/CSVExport.php::writeData()` wraps every cell in the con", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2p5x-4jr6-x5jg", "https://github.com/NeoRazorX/facturascripts", "https://osv.dev/vulnerability/GHSA-2p5x-4jr6-x5jg"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45693", "noindex": false, "published": "2026-07-14T17:12:56Z", "modified": "2026-07-14T17:41:43.025088Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45693", "title": "FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents", "description": "### Summary\n\nThe static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a `../` segment in the middle ends up serving a file from a different directory than the one the URL pretended to point at. This makes any file inside the FacturaScripts installation readable without authentication as long as the file's extension is on the controllers' allow-list (`pdf`, `xlsx`, `docx`, `csv`, `sql`, `zip`, `xml`, `json`, `xsig`, etc.). In practice this leaks the documents the application is s", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-cv65-7cg8-r623", "https://github.com/NeoRazorX/facturascripts", "https://osv.dev/vulnerability/GHSA-cv65-7cg8-r623"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45262", "noindex": false, "published": "2026-07-14T17:11:06Z", "modified": "2026-07-14T17:26:44.010294Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45262", "title": "FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`", "description": "## Summary\n\n> **Live PoC verified 2026-04-30** against a stock FacturaScripts master at `127.0.0.1:8081`. A scoped `ApiKey` with `fullaccess=0` and an `ApiAccess` row granting `allowget=1` on the `clientes` resource only (no other rights, no UI session, no admin) issued one `GET /api/3/clientes?filter[(0)UNION%20SELECT%20...]=` request and the response body contained the raw bcrypt hash of the admin user's password (`$2y$12$sLfA/XCqnjqLmYJwK.2V7eUHrHTHcQfkTYYfs1.lxX3OHrsmmkMGO`) and the admin's `logkey` cookie value. The leaked `logkey` was injected into a fresh cookie jar and `GET /AdminPlugins` returned 200 with the admin plugin management ", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-5qmh-x653-g8qj", "https://github.com/NeoRazorX/facturascripts", "https://osv.dev/vulnerability/GHSA-5qmh-x653-g8qj"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47677", "noindex": false, "published": "2026-07-13T23:35:48Z", "modified": "2026-07-13T23:56:39.400535Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47677", "title": "FacturaScripts: Account takeover of any 2FA-enabled user", "description": "# Authentication bypass in FacturaScripts: `/login?action=two-factor-validation` accepts brute-forceable TOTP without password or CSRF protection\n\n## Summary\n\n`Core/Controller/Login.php::twoFactorValidationAction()` accepts an\nunauthenticated POST containing only `fsNick` and `fsTwoFactorCode`. If the\nTOTP value matches, the server issues a full `fsNick` + `fsLogkey` session\ncookie pair. The handler:\n\n1. **Does not verify the password** — the user is not required to have just\n   completed `loginAction`.\n2. **Does not call `validateFormToken()`** — no CSRF token is required (every\n   other action handler in the same file does call it).\n3. **Do", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-c67f-gmxw-mj93", "https://github.com/NeoRazorX/facturascripts", "https://github.com/NeoRazorX/facturascripts/releases/tag/v2026.3"], "fixes": ["2026.3"], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-42877", "noindex": false, "published": "2026-05-27T18:37:06.291Z", "modified": "2026-05-28T15:15:20.904Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00194, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-42877", "title": "FacturaScripts: Stored XSS via product reference in sales/purchases", "description": "FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx", "https://nvd.nist.gov/vuln/detail/CVE-2026-42877"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-42879", "noindex": false, "published": "2026-05-27T18:29:46.718Z", "modified": "2026-06-01T17:08:32.048Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00229, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-42879", "title": "FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images", "description": "FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9", "https://nvd.nist.gov/vuln/detail/CVE-2026-42879"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-42878", "noindex": false, "published": "2026-05-27T18:28:05.666Z", "modified": "2026-05-28T15:12:12.260Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00902, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-42878", "title": "FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts", "description": "FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026.", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vrxf-vrc4-22p7", "https://nvd.nist.gov/vuln/detail/CVE-2026-42878"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-27964", "noindex": false, "published": "2026-05-18T22:05:02.529Z", "modified": "2026-05-19T13:01:06.903Z", "cvss": 3.9, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.00104, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-27964", "title": "FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation", "description": "FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8.", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-gq5c-rw37-g46c", "https://github.com/NeoRazorX/facturascripts/commit/9066e10326029adf012114e27eb5f3f33f78ecfd", "https://nvd.nist.gov/vuln/detail/CVE-2026-27964"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-27892", "noindex": false, "published": "2026-05-18T21:51:26.139Z", "modified": "2026-05-19T12:47:20.550Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00227, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-27892", "title": "FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download", "description": "FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could extract the uploader's embedded metadata, which included GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata. Of all FacturaScripts' image upload features, only the Library module combined unrestricted uploads, persistent storage, authenticated download access, and ", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-q7f2-rv22-2xgr", "https://github.com/NeoRazorX/facturascripts/commit/b0725147a61a9a377b7180589af33ff52b4751e2", "https://nvd.nist.gov/vuln/detail/CVE-2026-27892"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-27891", "noindex": false, "published": "2026-05-18T21:16:15.240Z", "modified": "2026-05-19T13:41:56.316Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00522, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-27891", "title": "Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism", "description": "FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. The vulnerability is located in Plugins.php. While the testZipFile function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that fo", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3pgc-xqg9-cfr6", "https://github.com/NeoRazorX/facturascripts/commit/2dda7c6f3b241fa84a0629166783720b882725fd", "https://nvd.nist.gov/vuln/detail/CVE-2026-27891"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-32699", "noindex": false, "published": "2026-05-05T19:00:19.957Z", "modified": "2026-05-05T19:44:45.408Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-32699", "title": "FacturaScripts unauthorized modification of immutable nick field via EditUser controller", "description": "FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pp79-hqv6-vmc3", "https://nvd.nist.gov/vuln/detail/CVE-2026-32699"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25513", "noindex": false, "published": "2026-02-04T19:59:57.190Z", "modified": "2026-02-05T14:32:21.989Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "high", "epss": 0.00537, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25513", "title": "FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause", "description": "FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-cjfx-qhwm-hf99", "https://github.com/NeoRazorX/facturascripts/commit/1b6cdfa9ee1bb3365ea4a4ad753452035a027605", "https://nvd.nist.gov/vuln/detail/CVE-2026-25513"], "fixes": ["2025.81"], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25514", "noindex": false, "published": "2026-02-04T19:59:54.847Z", "modified": "2026-02-05T14:32:26.569Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00532, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25514", "title": "FacturaScripts has SQL Injection vulnerability in Autocomplete Actions", "description": "FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pqqg-5f4f-8952", "https://github.com/NeoRazorX/facturascripts/commit/5c070f82665b98efd2f914a4769c6dc9415f5b0f", "https://nvd.nist.gov/vuln/detail/CVE-2026-25514"], "fixes": ["2025.81"], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-23476", "noindex": false, "published": "2026-02-02T20:49:05.731Z", "modified": "2026-02-03T15:33:51.348Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0029, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-23476", "title": "FacturaScripts Affected by Reflected XSS", "description": "FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-g6w2-q45f-xrp4", "https://github.com/NeoRazorX/facturascripts/commit/2afd98cecd26c5f8357e0e321d86063ad1012fc3", "https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.8"], "fixes": ["2025.81"], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-23997", "noindex": false, "published": "2026-02-02T20:19:45.182Z", "modified": "2026-02-03T15:06:30.329Z", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00429, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-23997", "title": "FacturaScripts has a Stored Cross-Site Scripting (XSS) in \"Observations\" field via History View", "description": "FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-4v7v-7v7r-3r5h", "https://nvd.nist.gov/vuln/detail/CVE-2026-23997"], "fixes": [], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-69210", "noindex": false, "published": "2025-12-30T19:23:31.130Z", "modified": "2025-12-30T19:47:52.458Z", "cvss": 1.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U", "severity": "low", "epss": 0.00972, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-69210", "title": "FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload", "description": "FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browse", "references": ["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2267-xqcf-gw2m", "https://facturascripts.com/publicaciones/ya-disponible-facturascripts-2025-7", "https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.7"], "fixes": ["2025.7"], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}, {"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}, {"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}, {"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-2066", "noindex": false, "published": "2022-06-13T12:15:14.000Z", "modified": "2024-08-03T00:24:44.275Z", "cvss": 7.1, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L", "severity": "high", "epss": 0.00955, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-2066", "title": "Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts", "description": "Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.", "references": ["https://huntr.dev/bounties/da4bbbfd-501f-4c7e-be83-47778103cb59", "https://github.com/neorazorx/facturascripts/commit/73a6595ca85984d65f656c6356fabb23d1936c54", "https://nvd.nist.gov/vuln/detail/CVE-2022-2066"], "fixes": ["2022.06"], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-2065", "noindex": false, "published": "2022-06-13T12:10:17.000Z", "modified": "2024-08-03T00:24:44.157Z", "cvss": 8.6, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "severity": "high", "epss": 0.00677, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-2065", "title": "Cross-site Scripting (XSS) - Stored in neorazorx/facturascripts", "description": "Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.", "references": ["https://huntr.dev/bounties/bcb44da4-d5c9-4830-924f-02d6defe6506", "https://github.com/neorazorx/facturascripts/commit/1d1edb40b40016d7fd2893b410b98569d7facca1", "https://nvd.nist.gov/vuln/detail/CVE-2022-2065"], "fixes": ["2022.06"], "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}]}], "total": 26, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "facturascripts/facturascripts", "path": "vulns/packagist/facturascripts%2Ffacturascripts", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-07-28T05:30:29.715095251Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}