CVE-2025-69210lowCWE-79

CVE-2025-69210: falha de baixa gravidade em NeoRazorX facturascripts

FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Publicada em

Seguir esta CVE+ Monitorar facturascripts+ Monitorar facturascripts/facturascripts

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 1.2epss 1.0%
da publicação à arma120 dias
Publicada no NVD30 de dez.
1ª PoC+120d
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
Produtos afetados
NeoRazorX · facturascripts
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — NeoRazorX facturascripts

No mesmo produto, das mais perigosas para as menos.

CVE-2026-42878MEDIUMFacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScriptsEPSS 0.9%CVE-2026-25513HIGHFacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseEPSS 0.5%CVE-2026-25514HIGHFacturaScripts has SQL Injection vulnerability in Autocomplete ActionsEPSS 0.5%CVE-2026-27891HIGHRemote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismEPSS 0.5%CVE-2026-104905MEDIUMFacturaScripts < 2026.7 PHP Object Injection via WidgetSelectEPSS 0.5%CVE-2026-23997HIGHFacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History ViewEPSS 0.4%