Read the docs
TI-2022-01387 Aliases CVE-2022-1514GHSA-p3w3-4ppm-c3f6

Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.

Why it matters now

EPSS 0.00766 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed neorazorx/facturascripts (neorazorx): 2022.06facturascripts/facturascripts (Packagist): 2022.06

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NeoRazorXneorazorx/facturascriptsbefore 2022.062022.06Patch availableCNA
—facturascripts/facturascripts (Packagist)before 2022.062022.06Patch availableGHSA-p3w3-4ppm-c3f6
  • neorazorx/facturascripts VendorNeoRazorX Affected before 2022.06 Fixed in 2022.06 Patch available CNA
  • facturascripts/facturascripts (Packagist) Vendor— Affected before 2022.06 Fixed in 2022.06 Patch available GHSA-p3w3-4ppm-c3f6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*before 2022.06VulnerableNeoRazorX
  • cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:* Versions before 2022.06 Vulnerable ·NeoRazorX

Remediation

  • Fix · CNA neorazorx/facturascripts (neorazorx) Fixed in 2022.06
  • Fix · GHSA-p3w3-4ppm-c3f6 facturascripts/facturascripts (Packagist) Fixed in 2022.06 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1514
  2. 2026-10-03 Alias added: GHSA-p3w3-4ppm-c3f6

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-19336 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVSS 3.1CRITICAL 9.0
  • TI-2022-01581 Account Takeover in neorazorx/facturascripts CVSS 3.1CRITICAL 9.8
  • TI-2026-20624 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions CVSS 4.0HIGH 8.7
  • TI-2026-20623 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause CVSS 4.0HIGH 8.3
  • TI-2022-01913 Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
  • TI-2022-01843 Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences