Read the docs
TI-2022-01331 Aliases CVE-2022-1457GHSA-8wp2-vxpg-xcvp

Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.

Why it matters now

EPSS 0.00752 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed neorazorx/facturascripts (neorazorx): 2022.04neorazorx/facturascripts (Packagist): 2022.04

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NeoRazorXneorazorx/facturascriptsbefore 2022.042022.04Patch availableCNA
—neorazorx/facturascripts (Packagist)before 2022.042022.04Patch availableGHSA-8wp2-vxpg-xcvp
  • neorazorx/facturascripts VendorNeoRazorX Affected before 2022.04 Fixed in 2022.04 Patch available CNA
  • neorazorx/facturascripts (Packagist) Vendor— Affected before 2022.04 Fixed in 2022.04 Patch available GHSA-8wp2-vxpg-xcvp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*before 2022.04VulnerableNeoRazorX
  • cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:* Versions before 2022.04 Vulnerable ·NeoRazorX

Remediation

  • Fix · CNA neorazorx/facturascripts (neorazorx) Fixed in 2022.04
  • Fix · GHSA-8wp2-vxpg-xcvp neorazorx/facturascripts (Packagist) Fixed in 2022.04 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1457
  2. 2026-10-03 Alias added: GHSA-8wp2-vxpg-xcvp

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-19336 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVSS 3.1CRITICAL 9.0
  • TI-2022-01581 Account Takeover in neorazorx/facturascripts CVSS 3.1CRITICAL 9.8
  • TI-2026-20624 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions CVSS 4.0HIGH 8.7
  • TI-2026-20623 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause CVSS 4.0HIGH 8.3
  • TI-2022-01913 Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
  • TI-2022-01843 Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences