Packagist/facturascripts/facturascripts

Account takeover in facturascripts

Modified: 11/8/2023

FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint

Modified: 9/10/2026

FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Modified: 2/3/2026

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

Modified: 7/14/2026

FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism

Modified: 5/7/2026

FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

Modified: 7/28/2026

FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View

Modified: 2/3/2026

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

Modified: 7/14/2026

Cross-site Scripting in facturascripts

Modified: 11/8/2023

FacturaScripts: Account takeover of any 2FA-enabled user

Modified: 7/13/2026

FacturaScripts has SQL Injection in API ORDER BY Clause

Modified: 2/4/2026

FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents

Modified: 7/14/2026

Cross-site Scripting in FacturaScripts

Modified: 11/8/2023

FacturaScripts is Vulnerable to Reflected XSS

Modified: 2/3/2026

FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

Modified: 9/10/2026

Cross site scripting in facturascripts

Modified: 11/8/2023

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

Modified: 7/14/2026

Cross-site Scripting in FacturaScripts

Modified: 11/8/2023

Cross-site Scripting in FacturaScripts

Modified: 11/8/2023

Cross site scripting in FacturaScripts

Modified: 11/8/2023

FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field

Modified: 5/7/2026

FacturaScripts has SQL Injection in Autocomplete Actions

Modified: 2/4/2026

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

Modified: 9/10/2026

FacturaScripts vulnerable to stored XSS via product reference in sales/purchases

Modified: 9/10/2026

Cross-site Scripting in FacturaScripts

Modified: 11/8/2023

FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

Modified: 9/10/2026