Refine your search
2 vulnerabilities found for FacturaScripts by FacturaScripts
CVE-2026-11960 (GCVE-0-2026-11960)
Vulnerability from cvelistv5
Published
2026-10-20 08:14
Modified
2026-10-20 15:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Summary
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| FacturaScripts | FacturaScripts |
Version: 2025.61 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:54:27.910773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:55:29.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FacturaScripts",
"vendor": "FacturaScripts",
"versions": [
{
"status": "affected",
"version": "2025.61"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daffi1238 \u0026\u0026 nandoll"
}
],
"datePublic": "2026-10-20T08:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application\u2019s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts."
}
],
"value": "Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application\u2019s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T08:14:27.662Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-facturascripts"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to commit llowing commits: https://github.com/NeoRazorX/facturascripts/commit/ac32f1e2f5ca8b16b5c8f023a3d8824faa693155."
}
],
"value": "Update to commit llowing commits: https://github.com/NeoRazorX/facturascripts/commit/ac32f1e2f5ca8b16b5c8f023a3d8824faa693155."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in FacturaScripts",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-11960",
"datePublished": "2026-10-20T08:14:27.662Z",
"dateReserved": "2026-06-11T07:47:56.552Z",
"dateUpdated": "2026-10-20T15:55:29.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11959 (GCVE-0-2026-11959)
Vulnerability from cvelistv5
Published
2026-10-20 08:13
Modified
2026-10-20 15:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Summary
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| FacturaScripts | FacturaScripts |
Version: 2025.61 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11959",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:54:03.683667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:54:13.922Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FacturaScripts",
"vendor": "FacturaScripts",
"versions": [
{
"status": "affected",
"version": "2025.61"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daffi1238 \u0026\u0026 nandoll"
}
],
"datePublic": "2026-10-20T08:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the \u2018city\u2019 and \u2018province\u2019 fields in the \u2018ListAlmacen\u2019 endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim\u2019s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system\u2019s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens)."
}
],
"value": "Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the \u2018city\u2019 and \u2018province\u2019 fields in the \u2018ListAlmacen\u2019 endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim\u2019s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system\u2019s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens)."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T08:13:28.580Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-facturascripts"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to commit llowing commits: https://github.com/NeoRazorX/facturascripts/commit/aa728f642b467bb73bf183067912bd97536d06a6"
}
],
"value": "Update to commit llowing commits: https://github.com/NeoRazorX/facturascripts/commit/aa728f642b467bb73bf183067912bd97536d06a6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in FacturaScripts",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-11959",
"datePublished": "2026-10-20T08:13:28.580Z",
"dateReserved": "2026-06-11T07:47:53.390Z",
"dateUpdated": "2026-10-20T15:54:13.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}