Facturascripts
NeoRazorX · 13 CVEs
FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
Oct 5, 2026
FacturaScripts: Stored XSS via product reference in sales/purchases
May 27, 2026
FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
May 27, 2026
FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts
May 27, 2026
FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
May 18, 2026
FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
May 18, 2026
Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
May 18, 2026
FacturaScripts unauthorized modification of immutable nick field via EditUser controller
May 5, 2026
FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause
Feb 4, 2026
FacturaScripts has SQL Injection vulnerability in Autocomplete Actions
Feb 4, 2026
FacturaScripts Affected by Reflected XSS
Feb 2, 2026
FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View
Feb 2, 2026
FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
Dec 30, 2025
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-104905 | FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect | MEDIUM | 0.51% | Oct 5, 2026 |
| CVE-2026-42877 | FacturaScripts: Stored XSS via product reference in sales/purchases | MEDIUM | 0.23% | May 27, 2026 |
| CVE-2026-42879 | FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images | MEDIUM | 0.31% | May 27, 2026 |
| CVE-2026-42878 | FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts | MEDIUM | 0.90% | May 27, 2026 |
| CVE-2026-27964 | FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation | LOW | 0.15% | May 18, 2026 |
| CVE-2026-27892 | FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download | MEDIUM | 0.39% | May 18, 2026 |
| CVE-2026-27891 | Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism | HIGH | 0.87% | May 18, 2026 |
| CVE-2026-32699 | FacturaScripts unauthorized modification of immutable nick field via EditUser controller | MEDIUM | 0.41% | May 5, 2026 |
| CVE-2026-25513 | FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause | HIGH | 0.57% | Feb 4, 2026 |
| CVE-2026-25514 | FacturaScripts has SQL Injection vulnerability in Autocomplete Actions | HIGH | 0.57% | Feb 4, 2026 |
| CVE-2026-23476 | FacturaScripts Affected by Reflected XSS | MEDIUM | 0.29% | Feb 2, 2026 |
| CVE-2026-23997 | FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View | CRITICAL | 0.44% | Feb 2, 2026 |
| CVE-2025-69210 | FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload | HIGH | 0.97% | Dec 30, 2025 |
Showing 1 to 13 of 13 CVEs