Is CVE-2026-42877 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42877 being exploited in the wild.

How severe is CVE-2026-42877?

Medium severity, with a CVSS score of 5.4, published 27 May 2026.

Which products and versions are affected?

NeoRazorX FacturaScripts <= 2025.92; facturascripts/facturascripts (Packagist) <= 2025.92, ECOSYSTEM:introduced=0,last_affected=2025.92.

Is there a fix for CVE-2026-42877?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42877 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42877?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42877: NeoRazorX FacturaScripts stored XSS in product search modals

Q: Is there a fix for CVE-2026-42877?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-42877 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42877?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42877 · Severity: medium · CVSS 5.4 · Published 2026-05-27

FacturaScripts, an open-source ERP and accounting system, is vulnerable to a security flaw where malicious code can be hidden in product reference fields. An employee with basic warehouse access could use this to target administrators, potentially taking over their accounts or stealing sensitive business data when the administrator views product lists in invoices or orders. This could lead to unauthorized financial transactions or full system compromise.

Technologies: NeoRazorX FacturaScripts, facturascripts/facturascripts (Packagist). Vendors: NeoRazorX, Packagist.

Quick answers

Is CVE-2026-42877 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42877 being exploited in the wild.
How severe is CVE-2026-42877?: Medium severity, with a CVSS score of 5.4, published 27 May 2026.
Which products and versions are affected?: NeoRazorX FacturaScripts <= 2025.92; facturascripts/facturascripts (Packagist) <= 2025.92, ECOSYSTEM:introduced=0,last_affected=2025.92.
Is there a fix for CVE-2026-42877?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42877 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42877?: Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in FacturaScripts versions up to 2025.92. The 'referencia' field in product variants is improperly sanitized when injected into HTML 'onclick' attributes within SalesModalHTML.php and PurchasesModalHTML.php. While initial input is encoded, the application later uses 'innerHTML' to render the product search modal, causing the browser to decode HTML entities and execute malicious JavaScript payloads. An authenticated attacker with warehouse write access can exploit this to perform actions on behalf of other users, including administrators, by creating a product with a crafted reference. Mitigation involves using htmlspecialchars() with ENT_QUOTES or transitioning to DOM-based rendering.

Affected products

NeoRazorX FacturaScripts <= 2025.92

Identifiers

CVE-2026-42877
GHSA-r736-2678-fcrx

Timeline

2026-05-07: advisory: GHSA-r736-2678-fcrx published
2026-05-07: disclosed
2026-05-27: other: NVD published CVE-2026-42877

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.