What is the CVSS score of CVE-2026-23997?

CVE-2026-23997 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Facturascripts are affected by CVE-2026-23997?

FacturaScripts instances running version 2025.71 and earlier contain a stored cross-site scripting vulnerability that allows attackers to inject malicious code into the Observations field,…

Is there a public PoC exploit available for CVE-2026-23997?

Yes, a public proof-of-concept exploit is available for CVE-2026-23997. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23997?

Within 24 hours: Identify all FacturaScripts deployments and their versions; restrict access to the Observations field to administrative users only and disable it where possible. Within 7 days: Implement WAF rules to sanitize input to the Observations field and conduct user awareness training on phishing/social engineering. Within 30 days: Monitor vendor communications closely for patch availability; prepare immediate deployment procedures; consider migrating to alternative ERP solutions if patch timeline is unclear.

Facturascripts CVE-2026-23997

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-02 security-advisories@github.com

GHSA-4v7v-7v7r-3r5h

XSS Facturascripts

8.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

PoC Detected

Feb 23, 2026 - 15:07 vuln.today

Public exploit code

CVE Published

Feb 02, 2026 - 23:16 nvd

HIGH 8.0

DescriptionGitHub Advisory

FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.

AnalysisAI

FacturaScripts versions 2025.71 and earlier contain a stored XSS vulnerability in the Observations field that executes arbitrary JavaScript when administrators view historical data. An authenticated attacker can inject malicious scripts that persist in the database and compromise admin sessions, with public exploit code already available. The vulnerability remains unpatched and requires administrator interaction to trigger.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Facturascripts. FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.