HIGHPackagist
GHSA-2267-xqcf-gw2m· CVE-2025-69210FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
Modified: 2/3/2026
package
Packagist/facturascripts/facturascripts
pkg:packagist/facturascripts/facturascripts
HIGH8.0Packagist
GHSA-2p5x-4jr6-x5jg· CVE-2026-45263FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
Modified: 7/14/2026
HIGH7.2Packagist
GHSA-3pgc-xqg9-cfr6· CVE-2026-27891FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
Modified: 5/7/2026
LOW3.5Packagist
GHSA-3x7p-v8hj-xh5m· CVE-2026-45710FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`
Modified: 7/28/2026
HIGH8.0Packagist
GHSA-4v7v-7v7r-3r5h· CVE-2026-23997FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View
Modified: 2/3/2026
CRITICAL9.9Packagist
GHSA-5qmh-x653-g8qj· CVE-2026-45262FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
Modified: 7/14/2026
MEDIUM6.1Packagist
GHSA-6465-r752-2h8v· CVE-2022-1682Cross-site Scripting in facturascripts
Modified: 11/8/2023
CRITICALPackagist
GHSA-c67f-gmxw-mj93· CVE-2026-47677FacturaScripts: Account takeover of any 2FA-enabled user
Modified: 7/13/2026
HIGHPackagist
GHSA-cjfx-qhwm-hf99· CVE-2026-25513FacturaScripts has SQL Injection in API ORDER BY Clause
Modified: 2/4/2026
HIGH7.5Packagist
GHSA-cv65-7cg8-r623· CVE-2026-45693FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents
Modified: 7/14/2026
MEDIUM5.4Packagist
GHSA-fp76-f299-v3hj· CVE-2022-2065Cross-site Scripting in FacturaScripts
Modified: 11/8/2023
MEDIUM5.4Packagist
GHSA-g6w2-q45f-xrp4· CVE-2026-23476FacturaScripts is Vulnerable to Reflected XSS
Modified: 2/3/2026
LOW3.9Packagist
GHSA-gq5c-rw37-g46c· CVE-2026-27964FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
Modified: 9/10/2026
MEDIUM6.1Packagist
GHSA-h6wm-mr85-4h9g· CVE-2022-2066Cross site scripting in facturascripts
Modified: 11/8/2023
CRITICAL9.9Packagist
GHSA-hgjx-r89m-m7v4FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE
Modified: 7/14/2026
MEDIUM5.4Packagist
GHSA-j8c7-3jpq-8985· CVE-2022-2016Cross-site Scripting in FacturaScripts
Modified: 11/8/2023
MEDIUM6.1Packagist
GHSA-m8gv-gvhf-7rhp· CVE-2022-1571Cross-site Scripting in FacturaScripts
Modified: 11/8/2023
CRITICAL9.0Packagist
GHSA-p3w3-4ppm-c3f6· CVE-2022-1514Cross site scripting in FacturaScripts
Modified: 11/8/2023
MEDIUM4.3Packagist
GHSA-pp79-hqv6-vmc3· CVE-2026-32699FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field
Modified: 5/7/2026
HIGHPackagist
GHSA-pqqg-5f4f-8952· CVE-2026-25514FacturaScripts has SQL Injection in Autocomplete Actions
Modified: 2/4/2026
MEDIUM6.5Packagist
GHSA-q7f2-rv22-2xgr· CVE-2026-27892FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
Modified: 9/10/2026
MEDIUM5.4Packagist
GHSA-r736-2678-fcrx· CVE-2026-42877FacturaScripts vulnerable to stored XSS via product reference in sales/purchases
Modified: 9/10/2026
MEDIUM6.5Packagist
GHSA-r7jw-mg27-j839· CVE-2022-1988Cross-site Scripting in FacturaScripts
Modified: 11/8/2023
MEDIUM6.3Packagist
GHSA-vf3q-frmr-vrr9· CVE-2026-42879FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
Modified: 9/10/2026
CRITICAL9.8Packagist
GHSA-vjq3-x3f2-fvxq· CVE-2022-1715Account takeover in facturascripts
Modified: 11/8/2023
MEDIUM5.3Packagist
GHSA-vrxf-vrc4-22p7· CVE-2026-42878FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint
Modified: 9/10/2026