Facturascripts
Monthly
FacturaScripts is open-source enterprise resource planning and accounting software. [CVSS 8.8 HIGH]
Authenticated users can execute arbitrary SQL commands against FacturaScripts REST API endpoints through unsanitized sort parameters in the ModelClass::getOrderBy() method, allowing data theft, modification, or deletion. Public exploit code exists for this vulnerability affecting all versions prior to 2025.81. Organizations using vulnerable FacturaScripts instances should immediately apply the available patch and restrict API access to trusted users.
FacturaScripts versions 2025.71 and earlier contain a stored XSS vulnerability in the Observations field that executes arbitrary JavaScript when administrators view historical data. An authenticated attacker can inject malicious scripts that persist in the database and compromise admin sessions, with public exploit code already available. The vulnerability remains unpatched and requires administrator interaction to trigger.
FacturaScripts 2025.61 can disclose valid usernames through observable differences in login responses, such as error-message text, HTTP status codes, or response timing. This is a low-to-moderate information-disclosure issue: it does not grant access or code execution by itself, but it can feed targeted brute-force, password-spraying, credential-stuffing, or social-engineering attempts. No public exploit was identified at time of analysis, and the vendor has released a patch according to the INCIBE advisory.
Stored cross-site scripting (CWE-79) in FacturaScripts 2025.61 lets authenticated low-privilege users inject JavaScript through the 'city' and 'province' fields handled by the ListAlmacen endpoint, with execution occurring when another user-realistically an administrator-views the affected warehouse listing. Successful exploitation can steal session/CSRF material even when cookies are HttpOnly, or enable privilege escalation from a normal user to administrator; however, the attack is conditional on victim interaction and warehouse-edit access, and no public exploit code was identified at time of analysis. The vendor reports a patch, and the issue is rated moderate severity (CVSS 4.0: 6.9).
PHP object injection in FacturaScripts before version 2026.7 allows an authenticated attacker to delete arbitrary files on the server, causing denial of service and potentially enabling a reinstall hijack that resets the application. The flaw is reachable through the multiple-select handling path in WidgetSelect::processFormData(), which passes raw POST data to unserialize() without restricting allowed classes; submitting a crafted serialized XLSXWriter object triggers its __destruct() destructor, which performs the file deletion (config.php and backup data are the notable targets). Exploitation requires a valid authenticated session (CVSS 4.0 vector reports PR:L, so an account is mandatory), and no public exploit code has been identified at time of analysis, so priority is moderate rather than urgent. The vendor has released the fixed 2026.7 version.
Reflected cross-site scripting in FacturaScripts prior to version 2025.8 allows authenticated attackers to inject malicious scripts through crafted input that triggers database errors, which are then rendered without HTML sanitization due to unsafe Twig template filters. Public exploit code exists for this vulnerability. The issue affects error message handling and requires user interaction to exploit, with impacts limited to session hijacking or credential theft within the affected user's browser context.
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
FacturaScripts is open-source enterprise resource planning and accounting software. [CVSS 8.8 HIGH]
Authenticated users can execute arbitrary SQL commands against FacturaScripts REST API endpoints through unsanitized sort parameters in the ModelClass::getOrderBy() method, allowing data theft, modification, or deletion. Public exploit code exists for this vulnerability affecting all versions prior to 2025.81. Organizations using vulnerable FacturaScripts instances should immediately apply the available patch and restrict API access to trusted users.
FacturaScripts versions 2025.71 and earlier contain a stored XSS vulnerability in the Observations field that executes arbitrary JavaScript when administrators view historical data. An authenticated attacker can inject malicious scripts that persist in the database and compromise admin sessions, with public exploit code already available. The vulnerability remains unpatched and requires administrator interaction to trigger.
FacturaScripts 2025.61 can disclose valid usernames through observable differences in login responses, such as error-message text, HTTP status codes, or response timing. This is a low-to-moderate information-disclosure issue: it does not grant access or code execution by itself, but it can feed targeted brute-force, password-spraying, credential-stuffing, or social-engineering attempts. No public exploit was identified at time of analysis, and the vendor has released a patch according to the INCIBE advisory.
Stored cross-site scripting (CWE-79) in FacturaScripts 2025.61 lets authenticated low-privilege users inject JavaScript through the 'city' and 'province' fields handled by the ListAlmacen endpoint, with execution occurring when another user-realistically an administrator-views the affected warehouse listing. Successful exploitation can steal session/CSRF material even when cookies are HttpOnly, or enable privilege escalation from a normal user to administrator; however, the attack is conditional on victim interaction and warehouse-edit access, and no public exploit code was identified at time of analysis. The vendor reports a patch, and the issue is rated moderate severity (CVSS 4.0: 6.9).
PHP object injection in FacturaScripts before version 2026.7 allows an authenticated attacker to delete arbitrary files on the server, causing denial of service and potentially enabling a reinstall hijack that resets the application. The flaw is reachable through the multiple-select handling path in WidgetSelect::processFormData(), which passes raw POST data to unserialize() without restricting allowed classes; submitting a crafted serialized XLSXWriter object triggers its __destruct() destructor, which performs the file deletion (config.php and backup data are the notable targets). Exploitation requires a valid authenticated session (CVSS 4.0 vector reports PR:L, so an account is mandatory), and no public exploit code has been identified at time of analysis, so priority is moderate rather than urgent. The vendor has released the fixed 2026.7 version.
Reflected cross-site scripting in FacturaScripts prior to version 2025.8 allows authenticated attackers to inject malicious scripts through crafted input that triggers database errors, which are then rendered without HTML sanitization due to unsafe Twig template filters. Public exploit code exists for this vulnerability. The issue affects error message handling and requires user interaction to exploit, with impacts limited to session hijacking or credential theft within the affected user's browser context.
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.