Read the docs
TI-2026-18909 Aliases CVE-2026-23476GHSA-g6w2-q45f-xrp4

FacturaScripts Affected by Reflected XSS

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed facturascripts (NeoRazorX): 2025.8facturascripts/facturascripts (Packagist): 2025.81

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NeoRazorXfacturascriptsbefore 2025.82025.8Patch availableCNA
—facturascripts/facturascripts (Packagist)before 2025.812025.81Patch availableGHSA-g6w2-q45f-xrp4
  • facturascripts VendorNeoRazorX Affected before 2025.8 Fixed in 2025.8 Patch available CNA
  • facturascripts/facturascripts (Packagist) Vendor— Affected before 2025.81 Fixed in 2025.81 Patch available GHSA-g6w2-q45f-xrp4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*before 2025.8VulnerableNeoRazorX
  • cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:* Versions before 2025.8 Vulnerable ·NeoRazorX

Remediation

  • Fix · CNA facturascripts (NeoRazorX) Fixed in 2025.8
  • Fix · GHSA-g6w2-q45f-xrp4 facturascripts/facturascripts (Packagist) Fixed in 2025.81 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23476
  2. 2026-10-03 Alias added: GHSA-g6w2-q45f-xrp4

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-19336 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVSS 3.1CRITICAL 9.0
  • TI-2022-01581 Account Takeover in neorazorx/facturascripts CVSS 3.1CRITICAL 9.8
  • TI-2026-20624 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions CVSS 4.0HIGH 8.7
  • TI-2026-20623 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause CVSS 4.0HIGH 8.3
  • TI-2022-01913 Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
  • TI-2022-01843 Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences