CVE-2026-27964Disclosure

LOWCVSS 3.9 · LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked at 2 mentions on most recent observed day (2026-05-19)
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-18	1	Disclosure1
2026-05-19	2	Disclosure2

Full discourse3 posts

Infoflowcloud@infoflowcloud144d
Disclosure
🚨*CVE* CVE-2026-27964 FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the… https://www.cve.org/CVERecord?id=CVE-2026-27964 ----- Traducción: CVE-2026-27964 Fac… http://infoflow.cloud`
Post summary
CVE‑2026‑27964 is disclosed as a Reflected XSS flaw affecting FacturaScripts 2025.7 and earlier, with a link to the CVE record but no PoC, exploit, or patch information provided.
0000050
78 followersView on X
CVE@CVEnew144d
Disclosure
CVE-2026-27964 FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the… https://www.cve.org/CVERecord?id=CVE-2026-27964
Post summary
The post announces a new reflected XSS vulnerability in FacturaScripts version 2025.7 and prior, with no PoC, exploit, or patch details provided.
00000188
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds144d
Disclosure
CVE-2026-27964 Reflected XSS Vulnerability in FacturaScripts 2025.7 via fsNick Cookie Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27964
Post summary
The post announces a Reflected XSS vulnerability (CVE-2026-27964) found in FacturaScripts 2025.7 via the fsNick cookie, but provides no PoC, exploit, patch, or active usage information.
0000062
4.0K followersView on X

Explore more

Back to dashboard