CVE-2025-69210lowCWE-79

CVE-2025-69210: fallo de gravedad baja en NeoRazorX facturascripts

FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Publicada el

Seguir esta CVE+ Monitorear facturascripts+ Monitorear facturascripts/facturascripts

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 1.2epss 1.0%
de la publicación al arma120 días
Publicada en NVD30 dic
1ª PoC+120d
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
Productos afectados
NeoRazorX · facturascripts
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — NeoRazorX facturascripts

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-42878MEDIUMFacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScriptsEPSS 0.9%CVE-2026-25513HIGHFacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseEPSS 0.5%CVE-2026-25514HIGHFacturaScripts has SQL Injection vulnerability in Autocomplete ActionsEPSS 0.5%CVE-2026-27891HIGHRemote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismEPSS 0.5%CVE-2026-104905MEDIUMFacturaScripts < 2026.7 PHP Object Injection via WidgetSelectEPSS 0.5%CVE-2026-23997HIGHFacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History ViewEPSS 0.4%