TI-2026-22307 Aliases CVE-2026-27964 GHSA-gq5c-rw37-g46c

FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

MEDIUM 52CWE-79Published 2026-05-18 · Updated 2026-05-19

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00104 1st percentileScored 2026-11-07

Fix Fixed facturascripts (NeoRazorX): 2025.8facturascripts/facturascripts (Packagist): 2025.8, 2025.81

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NeoRazorX	facturascripts	before 2025.8	2025.8	Patch available	CNA
—	facturascripts/facturascripts (Packagist)	before 2025.8	2025.8	Patch available	GHSA-gq5c-rw37-g46c
—	facturascripts/facturascripts (Packagist)	2025.11 to before 2025.81	2025.81	Patch available	GHSA-gq5c-rw37-g46c

facturascripts VendorNeoRazorX Affected before 2025.8 Fixed in 2025.8 Patch available CNA
facturascripts/facturascripts (Packagist) Vendor— Affected before 2025.8 Fixed in 2025.8 Patch available GHSA-gq5c-rw37-g46c
facturascripts/facturascripts (Packagist) Vendor— Affected 2025.11 to before 2025.81 Fixed in 2025.81 Patch available GHSA-gq5c-rw37-g46c

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:facturascripts:facturascripts::::::::	—	—	NeoRazorX

cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:* Versions — — ·NeoRazorX

Remediation

Fix · CNA facturascripts (NeoRazorX) Fixed in 2025.8
Fix · GHSA-gq5c-rw37-g46c facturascripts/facturascripts (Packagist) Fixed in 2025.8 Advisory →
Fix · GHSA-gq5c-rw37-g46c facturascripts/facturascripts (Packagist) Fixed in 2025.81 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-27964
2026-10-03 Alias added: GHSA-gq5c-rw37-g46c
2026-10-30 Fix available: Packagist/facturascripts/[email protected], Packagist/facturascripts/[email protected] · GHSA-gq5c-rw37-g46c

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-27964

Other 3

TI-2026-19336 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVSS 3.1CRITICAL 9.0
TI-2026-22235 Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism CVSS 3.1HIGH 7.2
TI-2026-31084 FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts CVSS 3.1MEDIUM 5.3
TI-2026-67841 PHP object injection in FacturaScripts via WidgetSelect CVSS 4.0MEDIUM 6.1
TI-2026-22236 FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download CVSS 3.1MEDIUM 6.5
TI-2026-31083 FacturaScripts: Stored XSS via product reference in sales/purchases CVSS 3.1MEDIUM 5.4

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences