TI-2025-42664 Aliases CVE-2025-69210 GHSA-2267-xqcf-gw2m

FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

LOW 10CWE-79Published 2025-12-30 · Updated 2025-12-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00972 62nd percentileScored 2026-11-07

Fix Fixed facturascripts (NeoRazorX): 2025.7facturascripts/facturascripts (Packagist): 2025.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NeoRazorX	facturascripts	before 2025.7	2025.7	Patch available	CNA
—	facturascripts/facturascripts (Packagist)	before 2025.7	2025.7	Patch available	GHSA-2267-xqcf-gw2m
—	facturascripts/facturascripts (Packagist)	—	—	No fix listed	GHSA-2267-xqcf-gw2m
—	facturascripts/facturascripts (Packagist)	—	—	No fix listed	GHSA-2267-xqcf-gw2m
—	facturascripts/facturascripts (Packagist)	—	—	No fix listed	GHSA-2267-xqcf-gw2m

facturascripts VendorNeoRazorX Affected before 2025.7 Fixed in 2025.7 Patch available CNA
facturascripts/facturascripts (Packagist) Vendor— Affected before 2025.7 Fixed in 2025.7 Patch available GHSA-2267-xqcf-gw2m
facturascripts/facturascripts (Packagist) Vendor— Affected — Fixed in — No fix listed GHSA-2267-xqcf-gw2m
facturascripts/facturascripts (Packagist) Vendor— Affected — Fixed in — No fix listed GHSA-2267-xqcf-gw2m
facturascripts/facturascripts (Packagist) Vendor— Affected — Fixed in — No fix listed GHSA-2267-xqcf-gw2m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:facturascripts:facturascripts::::::::	before 2025.7	Vulnerable	NeoRazorX

cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:* Versions before 2025.7 Vulnerable ·NeoRazorX

Remediation

Fix · CNA facturascripts (NeoRazorX) Fixed in 2025.7
Fix · GHSA-2267-xqcf-gw2m facturascripts/facturascripts (Packagist) Fixed in 2025.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-69210
2026-10-03 Alias added: GHSA-2267-xqcf-gw2m

References

Advisory 2

Other 4

TI-2026-19336 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVSS 3.1CRITICAL 9.0
TI-2022-01581 Account Takeover in neorazorx/facturascripts CVSS 3.1CRITICAL 9.8
TI-2026-20624 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions CVSS 4.0HIGH 8.7
TI-2026-20623 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause CVSS 4.0HIGH 8.3
TI-2022-01913 Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
TI-2022-01843 Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences