Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-23476 Reflected XSS Vulnerability in FacturaScripts Prior to Version 2025.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23476
Post summary
This post identifies CVE‑2026‑23476 as a reflected XSS vulnerability affecting FacturaScripts before version 2025.8. No additional details on exploitation, mitigation, or verification are provided.
CVE-2026-23476 FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in ho… https://www.cve.org/CVERecord?id=CVE-2026-23476
Post summary
The text announces a reflected XSS vulnerability in FacturaScripts versions before 2025.8, providing basic technical details but no information on exploitation, patches, or PoC.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | facturascripts | facturascripts | - | - | - |