NeoRazorX facturascripts

• CVE-2026-104905 High 8.1 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect 0.5%
• CVE-2026-42877 Medium 5.4 FacturaScripts: Stored XSS via product reference in sales/purchases 0.2%
• CVE-2026-42879 Medium 6.3 FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images 0.2%
• CVE-2026-42878 Medium 5.3 FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts 0.9%
• CVE-2026-27964 Low 3.9 FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation 0.1%
• CVE-2026-27892 Medium 6.5 FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download 0.2%
• CVE-2026-27891 High 7.2 Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism 0.5%
• CVE-2026-32699 Medium 5.3 FacturaScripts unauthorized modification of immutable nick field via EditUser controller 0.3%
• CVE-2026-25513 High 8.3 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause 0.5%
• CVE-2026-25514 High 8.7 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions 0.5%
• CVE-2026-23476 Medium 5.4 FacturaScripts Affected by Reflected XSS 0.3%
• CVE-2026-23997 High 8.0 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View 0.4%
• CVE-2025-69210 Low 1.2 FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload 1.0%