CVE-2026-42877: fallo de gravedad media en NeoRazorX facturascripts
FacturaScripts: Stored XSS via product reference in sales/purchases
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.2%
FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
NeoRazorX · facturascriptsCVEs relacionadas — NeoRazorX facturascripts
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-69210LOWFacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File UploadEPSS 1.0%CVE-2026-42878MEDIUMFacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScriptsEPSS 0.9%CVE-2026-25513HIGHFacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseEPSS 0.5%CVE-2026-25514HIGHFacturaScripts has SQL Injection vulnerability in Autocomplete ActionsEPSS 0.5%CVE-2026-27891HIGHRemote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismEPSS 0.5%CVE-2026-104905MEDIUMFacturaScripts < 2026.7 PHP Object Injection via WidgetSelectEPSS 0.5%