Skip to content
OpenAdvisories

Package · Packagist

facturascripts/facturascripts

26 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.5
    CVE-2026-45710

    FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

    ## Summary `WidgetVariante::renderVariantList` (`Core/Lib/Widget/WidgetVariante.php:298-330`) and `WidgetSubcuenta::renderSubaccountList` (`Core/Lib/Widget/WidgetSubcuenta.php:290-321`) build the `<tr onclick="...">` row for each modal hit by concatenating th…

    facturascripts/facturascripts Packagist
  • Low 3.9
    CVE-2026-27964

    FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

    FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML …

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Low 1.2
    CVE-2025-69210 Public exploit

    FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files co…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist