Executive brief
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View
Affected products
- Packagist facturascripts/facturascripts
Junglewise Threat Intelligence
CVE-2026-23997: FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View
CVE-2026-23997 · Severity: low · CVSS 3.1 · Published 2026-02-02
Technologies: facturascripts/facturascripts (Packagist). Vendors: Packagist.
Related threats
- FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() , arbitrary file write outside MyFiles/ leading to RCE
- FacturaScripts path traversal and RCE in UploadedFile move
- FacturaScripts stored XSS in WidgetVariante and WidgetSubcuenta
- FacturaScripts CSV formula injection in CSVExport
- FacturaScripts path traversal in static file controllers