Executive brief
FacturaScripts, an open-source ERP and accounting system, is vulnerable to a security flaw where malicious code can be hidden in product reference fields. An employee with basic warehouse access could use this to target administrators, potentially taking over their accounts or stealing sensitive business data when the administrator views product lists in invoices or orders. This could lead to unauthorized financial transactions or full system compromise.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in FacturaScripts versions up to 2025.92. The 'referencia' field in product variants is improperly sanitized when injected into HTML 'onclick' attributes within SalesModalHTML.php and PurchasesModalHTML.php. While initial input is encoded, the application later uses 'innerHTML' to render the product search modal, causing the browser to decode HTML entities and execute malicious JavaScript payloads. An authenticated attacker with warehouse write access can exploit this to perform actions on behalf of other users, including administrators, by creating a product with a crafted reference. Mitigation involves using htmlspecialchars() with ENT_QUOTES or transitioning to DOM-based rendering.
Affected products
- NeoRazorX FacturaScripts <= 2025.92
Timeline
- 2026-05-07: advisory: GHSA-r736-2678-fcrx published
- 2026-05-07: disclosed
- 2026-05-27: other: NVD published CVE-2026-42877