What’s Vulnerable › Vulnerabilities

CVE-2026-42877: FacturaScripts: Stored XSS via product reference in sales/purchases

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-27 · updated 2026-10-26
• Weakness: CWE-79

Description

FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.

Affected products

• NeoRazorX facturascripts: through 2025.92

References

• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx

Get alerted when CVE-2026-42877 or the next vulnerability affects your stack