Skip to content
OpenAdvisories

Vendor

factionsecurity

5 known vulnerabilities.

factionsecurity at a glance

Last 12 months
4
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 3 vulnerabilities, 1 critical June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202631
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202511
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202510
Feb 202500
Jan 202500
Dec 202400

Products

faction 5
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Critical 9.8
    CVE-2026-44668

    Faction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates

    FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action metho…

    factionsecurity faction
  • High 8.7
    CVE-2026-44669

    Faction: Stored XSS in Assessment Attachment Filename Preview Rendering

    FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in assessment file preview flows. User-supplied filename values are persisted and later …

    factionsecurity faction
  • High 8.7
    CVE-2026-44667

    Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering

    FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in remediation verification file preview flows. User-supplied filename values are persis…

    factionsecurity faction
  • Critical 9.7
    CVE-2025-66022

    FACTION Unauthenticated Custom Extension Upload leads to RCE

    FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle ho…

    factionsecurity faction
  • High 7.5
    CVE-2025-27422

    FACTION Allows Authentication Bypass via User Creation

    FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules…

    factionsecurity faction