Vulnerabilities

Filters

1 selected

24 records

Sort

Vendor: NeoRazorX Clear all filters

TI-2026-76723 CVE-2026-11960 · GHSA-jfpr-pfqx-2q8x

Username enumeration in FacturaScripts login

LOW 30

Enumeration of unauthenticated users in FacturaScripts, version 2025.61.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00341 Published 2026-10-20 No fix listed CWE-79

TI-2026-76722 CVE-2026-11959 · GHSA-hm23-2mjw-57qx

Stored cross-site scripting in FacturaScripts lets attackers run scripts

LOW 30

Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.003 Published 2026-10-20 No fix listed CWE-79

TI-2026-67841 CVE-2026-104905 · GHSA-8rvh-x87q-rm2p

PHP object injection in FacturaScripts via WidgetSelect

MEDIUM 62

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_class…

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00507 Published 2026-10-05 Fixed in 2026.7 CWE-502

TI-2026-31083 CVE-2026-42877 · GHSA-r736-2678-fcrx

FacturaScripts: Stored XSS via product reference in sales/purchases

MEDIUM 58

FacturaScripts is an open source accounting and invoicing software.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00194 Published 2026-05-27 No fix listed CWE-79

TI-2026-31085 CVE-2026-42879 · GHSA-vf3q-frmr-vrr9

FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

LOW 27

FacturaScripts is an open source accounting and invoicing software.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00229 Published 2026-05-27 No fix listed CWE-434

TI-2026-31084 CVE-2026-42878 · GHSA-vrxf-vrc4-22p7

FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts

MEDIUM 63

FacturaScripts is an open source accounting and invoicing software.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00902 Published 2026-05-27 Fixed in v2026 CWE-200

TI-2026-22307 CVE-2026-27964 · GHSA-gq5c-rw37-g46c

FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

MEDIUM 52

FacturaScripts is an open source accounting and invoicing software.

CVSS 3.1LOW 3.9 Local Low privileges User interaction EPSS 0.00104 Published 2026-05-18 Fixed in 2025.8, 2025.81 CWE-79

TI-2026-22236 CVE-2026-27892 · GHSA-q7f2-rv22-2xgr

FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

MEDIUM 62

FacturaScripts is an open source accounting and invoicing software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00227 Published 2026-05-18 Fixed in 2026 CWE-200

TI-2026-22235 CVE-2026-27891 · GHSA-3pgc-xqg9-cfr6

Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism

HIGH 67

FacturaScripts is an open source accounting and invoicing software.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00522 Published 2026-05-18 Fixed in 2026.1 CWE-20

TI-2026-25191 CVE-2026-32699 · GHSA-pp79-hqv6-vmc3

FacturaScripts unauthorized modification of immutable nick field via EditUser controller

MEDIUM 57

FacturaScripts is an open source accounting and invoicing software.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0033 Published 2026-05-05 No fix listed CWE-472

TI-2026-20623 CVE-2026-25513 · GHSA-cjfx-qhwm-hf99

FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause

LOW 37

FacturaScripts is open-source enterprise resource planning and accounting software.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00524 Published 2026-02-04 Fixed in 2025.81 CWE-1286

TI-2026-20624 CVE-2026-25514 · GHSA-pqqg-5f4f-8952

FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

MEDIUM 40

FacturaScripts is open-source enterprise resource planning and accounting software.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00524 Published 2026-02-04 Fixed in 2025.81 CWE-20

TI-2026-18909 CVE-2026-23476 · GHSA-g6w2-q45f-xrp4

FacturaScripts Affected by Reflected XSS

LOW 24

FacturaScripts is open-source enterprise resource planning and accounting software.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0029 Published 2026-02-02 Fixed in 2025.8, 2025.81 CWE-79

TI-2026-19336 CVE-2026-23997 · GHSA-4v7v-7v7r-3r5h

FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View

HIGH 74

FacturaScripts is open-source enterprise resource planning and accounting software.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00429 Published 2026-02-02 No fix listed CWE-79

TI-2025-42664 CVE-2025-69210 · GHSA-2267-xqcf-gw2m

FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

LOW 10

FacturaScripts is open-source enterprise resource planning and accounting software.

CVSS 4.0LOW 1.2 Network Low privileges User interaction EPSS 0.00972 Published 2025-12-30 Fixed in 2025.7 CWE-79

TI-2022-01913 CVE-2022-2066 · GHSA-h6wm-mr85-4h9g

Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts

LOW 29

Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0097 Published 2022-06-13 Fixed in 2022.06 CWE-79

TI-2022-01912 CVE-2022-2065 · GHSA-fp76-f299-v3hj

Cross-site Scripting (XSS) - Stored in neorazorx/facturascripts

LOW 26

Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00687 Published 2022-06-13 Fixed in 2022.06 CWE-79

TI-2022-01869 CVE-2022-2016 · GHSA-j8c7-3jpq-8985

Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts

LOW 26

Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00687 Published 2022-06-07 Fixed in 2022.1 CWE-79

TI-2022-01843 CVE-2022-1988 · GHSA-r7jw-mg27-j839

Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts

LOW 29

Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00782 Published 2022-06-03 Fixed in 2022.09 CWE-79

TI-2022-01581 CVE-2022-1715 · GHSA-vjq3-x3f2-fvxq

Account Takeover in neorazorx/facturascripts

MEDIUM 45

Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0142 Published 2022-05-13 Fixed in 2022.07, 2022.08 CWE-1125

TI-2022-01550 CVE-2022-1682 · GHSA-6465-r752-2h8v

Reflected Xss using url based payload in neorazorx/facturascripts

LOW 29

Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00758 Published 2022-05-12 Fixed in 2022.07, 2022.08 CWE-79

TI-2022-01442 CVE-2022-1571 · GHSA-m8gv-gvhf-7rhp

Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts

LOW 29

Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0087 Published 2022-05-04 Fixed in 2022.07 CWE-79

TI-2022-01387 CVE-2022-1514 · GHSA-p3w3-4ppm-c3f6

Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts

LOW 26

Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00766 Published 2022-04-28 Fixed in 2022.06 CWE-79

TI-2022-01331 CVE-2022-1457 · GHSA-8wp2-vxpg-xcvp

Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts

LOW 26

Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00752 Published 2022-04-25 Fixed in 2022.04 CWE-79