Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.wolterskluwer.es/#/incomes/salesDeliveryNotes' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-2680 Reflected XSS in A3Factura Web Platform via CustomerVATNumber Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2680
Post summary
A3Factura Web Platform is vulnerable to reflected XSS via the CustomerVATNumber parameter (CVE-2026-2680). No PoC, exploit, patch, or active exploitation details are provided.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-2680 - Multiple vulnerabilities in A3factura software Intel Report: https://ift.tt/nlzpNsO
Post summary
Alert announces CVE-2026-2680 affecting A3factura software, with a link to an Intel Report but no further technical or exploit details.
CVE-2026-2680 Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerVATNumber', in 'http://a3factura-app.wolterskluwer.es/#/incomes/salesDeliveryNotes' e… https://www.cve.org/CVERecord?id=CVE-2026-2680
Post summary
The post discloses a reflected XSS vulnerability in the A3factura web platform, detailing the affected parameter and URL, but does not provide a PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wolterskluwer | a3factura | 4.111.2 | - | - |