Vulnerability · Published May 27, 2026 · Assigned by GitHub_M
CVE-2026-42877FacturaScripts: Stored XSS via product reference in sales/purchases
Medium 5.4
In plain English
A medium-severity cross-site scripting in facturascripts from NeoRazorX. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | facturascripts/facturascripts | no fix listed | GHSA-r736-2678-fcrx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NeoRazorX | facturascripts | <= 2025.92 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N