Multiple vulnerabilities in FacturaScripts
Posted date 20/10/2026
Identificador
INCIBE-2026-759
Importance
3 - Medium
Affected Resources
FacturaScripts:2025.61
Description
INCIBE has coordinated the disclosure of two medium-severity vulnerabilities affecting FacturaScripts, an open-source accounting and invoicing programme. The vulnerabilities were discovered by daffi1238 && nandoll.
These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector and CWE vulnerability type for each vulnerability:
- CVE-2026-11959 y CVE-2026-11960: CVSS v4.0: 6.9| CVSS AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CWE-79
Solution
Both vulnerabilities have been fixed in the following commits:
Detail
- CVE-2026-11959: Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).
- CVE-2026-11960: enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts.
CVE
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-11959 | Media | No | FacturaScripts |
| CVE-2026-11960 | Media | No | FacturaScripts |
References list
Etiquetas
