CVE-2025-69210

LOW

FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-69210 has a selected CVSS score of 1.2 (low); EIP currently links 1 catalogued exploit.

Description

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 30, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

facturascripts

Browse NeoRazorX / facturascripts
CVE List< 2025.7affected

facturascripts/facturascripts

Browse Packagist / facturascripts/facturascripts
GitHub AdvisoryBefore 2025.7 · Fixed in 2025.7affected
2025.11affected
2025.41affected
2025.43affected

Proofs of concept

1

Catalogued exploits

ExploitDBFacturaScripts 2025.43 - XSSExploitDB exploitby uvettrivel007Exploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a complete stored XSS exploit against FacturaScripts 2025.43. It includes a crafted XML payload with multiple XSS vectors (namespace-wrapped script tags and CDATA-embedded script) and step-by-step instructions for uploading the file as an authenticated user, then triggering execution when an administrator accesses the file.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a standard proof-of-concept exploit description for CVE-2025-69210, a stored XSS vulnerability in FacturaScripts. It contains only documentation, reproduction steps, and example payloads that demonstrate the claimed XSS behavior (alert and redirect). No concealed executable behavior, persistence, credential theft, or unrelated remote access is present. The payloads are inline and consistent with the disclosed vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesHTMLXMLJavaScript
Target softwareFacturaScripts
Attack typesStored Cross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable exploit code: a complete XML payload with multiple XSS vectors (lines 53-91) and a full HTTP request template (lines 45-93) that, when sent by an authenticated attacker, stores the payload. The instructions describe triggering execution by accessing the uploaded file (lines 97-100), which constitutes exploitation, not mere detection.

exploits/multiple/webapps/52517.txt:53-91exploits/multiple/webapps/52517.txt:45-93exploits/multiple/webapps/52517.txt:97-100

Requirements

  • Authenticated access as a normal user to FacturaScripts instanceexploits/multiple/webapps/52517.txt:28
  • Ability to upload files to a product (or intercept and modify upload request)exploits/multiple/webapps/52517.txt:40-42
  • Victim (e.g., administrator) must access the uploaded XML file via the generated URLexploits/multiple/webapps/52517.txt:97-100

Observed behavior

  • Uploads a crafted XML file containing multiple XSS payloads (namespace-wrapped script tags and CDATA-embedded script) via a multipart POST requestexploits/multiple/webapps/52517.txt:45-93
  • When the uploaded file is accessed, the browser executes the embedded JavaScript, displaying an alert('XSS') and optionally redirecting to an attacker-controlled domainexploits/multiple/webapps/52517.txt:56-68exploits/multiple/webapps/52517.txt:74-79exploits/multiple/webapps/52517.txt:103-105
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldExample attacker-controlled domain used in XSS payload redirect demonstrations.exploits/multiple/webapps/52517.txt:60exploits/multiple/webapps/52517.txt:67exploits/multiple/webapps/52517.txt:77
Url
Payload withheldExample benign URL used in the XML payload's info section.exploits/multiple/webapps/52517.txt:87
Review boundaries

What the analysis did not establish

  • Evidence is limited to the single text file from ExploitDB; no external tools, libraries, or referenced resources were analyzed.
  • The artifact includes an HTTP request template with placeholder cookies; actual exploitation requires valid authenticated session cookies.
  • The artifact does not include a fully automated script; the exploit steps require manual interaction or adaptation.
  • Only the readable text of the exploit file was reviewed; no binary files or external resources were inspected.
  • The review does not verify the exploit works or assess the safety of the target application.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

6