FacturaScripts EUVD-2026-104833

Exploitation requires an authenticated account with at least low privileges that can create or edit warehouse (Almacen) records through the ListAlmacen endpoint, because the payload is injected into the stored 'city' and 'province' fields. Triggering requires a second user - realistically an administrator - to subsequently view the affected warehouse listing (UI:P/UI:R), so the attack is not self-contained and depends on victim interaction. Limiting factors: the attacker cannot be fully unauthenticated (PR:L), the privilege-escalation outcome depends on an administrator being the viewer, and the flaw is specific to FacturaScripts version 2025.61; deployments restricting account creation or warehouse-edit permissions sharply reduce exposure.

This is a moderate-severity stored XSS (CWE-79) with signals that point to a real but conditional, not widespread, threat. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N) indicates a network-reachable, low-complexity attack that nonetheless requires an authenticated low-privileged account (PR:L) and passive victim interaction (UI:P) - so it is not a drive-by, unauthenticated flaw. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or automated exploitation; by the precision rules this is 'no public exploit identified at time of analysis.' The main elevating factor is the described impact: a stored payload executing in an administrator's browser could hijack the session and escalate from normal user to administrator (consistent with VC:H), which is why the score reaches 6.9 despite the authentication prerequisite. Net assessment: a legitimate priority for organizations that expose FacturaScripts to multiple or untrusted users, but lower urgency where accounts are tightly controlled, because the attacker must already hold a valid low-privilege account and an authenticated admin must view the malicious warehouse record. A patch is available, so remediation is straightforward.

A low-privileged authenticated user saves a warehouse record via the ListAlmacen endpoint with a malicious JavaScript payload embedded in the 'city' or 'province' field. When an administrator later views that warehouse listing, the stored script executes in the admin's browser session, extracting CSRF tokens (even with httpOnly cookies) and issuing requests that elevate the attacker's account to administrator. No public exploit code is identified in the available data, but the technique is standard stored XSS and requires only a valid low-privilege account plus a victim viewing the page.