CVE-2026-23997
📋 TL;DR
A stored XSS vulnerability in FacturaScripts allows attackers to inject malicious JavaScript into the Observations field, which executes when administrators view the History section. This affects all users of FacturaScripts versions 2025.71 and earlier. The vulnerability enables session hijacking, data theft, and administrative account compromise.
💻 Affected Systems
- FacturaScripts
⚠️ Risk & Real-World Impact
Worst Case
Administrator account takeover leading to complete system compromise, data exfiltration, and further malware deployment.
Likely Case
Session hijacking allowing unauthorized access to sensitive financial data and administrative functions.
If Mitigated
Limited impact with proper input validation and output encoding in place.
🎯 Exploit Status
Exploitation requires user interaction (admin viewing history) but payload delivery is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.72 or later
Vendor Advisory: https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-4v7v-7v7r-3r5h
Restart Required: No
Instructions:
1. Backup your FacturaScripts installation and database. 2. Download the latest version from the official repository. 3. Replace the existing installation files with the updated version. 4. Clear browser caches and test functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize Observations field content
Modify PHP code to apply htmlspecialchars() or similar sanitization to Observations field before storage
🧯 If You Can't Patch
- Restrict access to History view to only essential administrators
- Implement Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check FacturaScripts version in admin panel or by examining version filesCheck Version:
Check the version.php file or admin dashboard for version informationVerify Fix Applied:
Test if HTML/JavaScript entered in Observations field is properly encoded when displayed in History view📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript patterns in Observations field entries
- Multiple failed login attempts from admin accounts
Network Indicators:
- Unexpected outbound connections from FacturaScripts server
SIEM Query:
source="facturascripts" AND (message="*<script>*" OR message="*javascript:*")