VulnSocial

CVE-2026-42878Disclosure

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-05-27); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-05-27: 1Mentions · 2026-08-26: 1Mentions · 2026-09-03: 1PoC Mentioned / Linked · 2026-08-26: 1Patch / Workaround · 2026-09-03: 1Technical Details · 2026-05-27: 1Technical Details · 2026-08-26: 1Technical Details · 2026-09-03: 105-2708-2609-03
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-05-271
Disclosure1
2026-08-261
Disclosure1
2026-09-031
Patch1
Full discourse3 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-42878 - medium 🚨 FacturaScripts - Unauthenticated phpinfo Disclosure > Detected FacturaScripts exposes a debug branch in the Installer controller that calls... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-42878 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet announces CVE‑2026‑42878, an unauthenticated phpinfo disclosure in FacturaScripts caused by a debug branch in the installer, and links to an online library entry likely containing a PoC or detection template.

    01012333
    1.2K followersView on X
  • FacturaScripts@facturascripts
    Patch

    Sobre CVE-2026-42878 (phpinfo en el instalador): está resuelto desde FacturaScripts 2026.1, finales de abril. Si ya actualizasteis después, no hay que hacer nada.

    Post summary

    The message confirms that CVE-2026-42878 is fixed in FacturaScripts 2026.1 released in late April, requiring no further action for those already updated.

    10000175
    811 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-42878 FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controlle… https://www.cve.org/CVERecord?id=CVE-2026-42878

    Post summary

    The text announces CVE‑2026‑42878, an unauthenticated information disclosure flaw in FacturaScripts’ Installer controller, providing only that technical detail and linking to the CVE record.

    00000195
    57.5K followersView on X

Explore more

Back to dashboard