CVE-2026-23476

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23476
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/NeoRazorX/facturascripts/commit/2afd98cecd26c5f8357e0e321d86063ad1012fc3 Patch
https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.8 Release Notes
https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-g6w2-q45f-xrp4 Exploit Vendor Advisory Mitigation
Configurations

Configuration 1 (hide)

cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*
History

23 Feb 2026, 15:32

Type Values Removed Values Added
References () https://github.com/NeoRazorX/facturascripts/commit/2afd98cecd26c5f8357e0e321d86063ad1012fc3 - () https://github.com/NeoRazorX/facturascripts/commit/2afd98cecd26c5f8357e0e321d86063ad1012fc3 - Patch
References () https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.8 - () https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.8 - Release Notes
References () https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-g6w2-q45f-xrp4 - () https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-g6w2-q45f-xrp4 - Exploit, Vendor Advisory, Mitigation
Summary
  • (es) FacturaScripts es un software de planificación de recursos empresariales y contabilidad de código abierto. Antes de la versión 2025.8, existía un fallo de XSS reflejado en FacturaScripts. El problema radica en cómo se muestran los mensajes de error. Se utiliza el filtro |raw de Twig, lo que omite el escape de HTML. Al activar un error de base de datos (como pasar una cadena donde se espera un número entero), el mensaje de error incluye la entrada y se renderiza sin sanitización. Esta vulnerabilidad se ha corregido en la versión 2025.8.
First Time Facturascripts
Facturascripts facturascripts
CPE cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*

02 Feb 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-02 23:16

Updated : 2026-02-23 15:32

NVD link : CVE-2026-23476

Mitre link : CVE-2026-23476

CVE.ORG link : CVE-2026-23476

JSON object : View

Products Affected

facturascripts

  • facturascripts
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')