Skip to content
OpenAdvisories

Vendor

NeoRazorX

22 known vulnerabilities.

Products

facturascripts 13 neorazorx/facturascripts 9
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-42877

    FacturaScripts: Stored XSS via product reference in sales/purchases

    FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Medium 6.3
    CVE-2026-42879 Public exploit

    FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

    FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a P…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Medium 5.3
    CVE-2026-42878 Scanner template

    FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts

    FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by req…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Medium 6.5
    CVE-2026-27892

    FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

    FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could e…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Medium 5.3
    CVE-2026-32699 Public exploit

    FacturaScripts unauthorized modification of immutable nick field via EditUser controller

    FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Medium 5.4
    CVE-2026-23476

    FacturaScripts Affected by Reflected XSS

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When …

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Medium 6.8
    CVE-2022-2016

    Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts

    Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.

    NeoRazorX neorazorx/facturascripts facturascripts/facturascripts Packagist
  • Medium 6.5
    CVE-2022-1988

    Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts

    Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.

    NeoRazorX neorazorx/facturascripts facturascripts/facturascripts Packagist