CVE-2026-23476

MEDIUM

FacturaScripts Affected by Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-23476 has a selected CVSS score of 5.4 (medium).

Description

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 3, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

facturascripts

Browse NeoRazorX / facturascripts
CVE List< 2025.8affected

facturascripts/facturascripts

Browse Packagist / facturascripts/facturascripts
GitHub AdvisoryBefore 2025.81 · Fixed in 2025.81affected

References

5