CVE-2026-42877CWE-79

FacturaScripts: Stored XSS via product reference in sales/purchases

Medium · published May 27, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-27T18:37Z
EPSS history
Timeline
  • 27 MAY 18:37Z
    FacturaScripts: Stored XSS via product reference in sales/purchases
    cvelistv5