Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Oct 20, 2026Enumeration of unauthenticated users in FacturaScripts, version 2025.61.CVE-2026-11960 · Other software · FacturaScripts · reported by cve-coordination@incibe.esMedium 6.9
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts.
- Product
- FacturaScripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘pCVE-2026-11959 · Other software · FacturaScripts · reported by cve-coordination@incibe.esMedium 6.9
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).
- Product
- FacturaScripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to triCVE-2026-104905 · Other software · NeoRazorX · reported by VulnCheckMedium 6.1
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-42877 · Other software · NeoRazorX · reported by GitHubMedium 5.4
FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-42879 · Other software · NeoRazorX · reported by GitHubMedium 6.3
FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-42878 · Other software · NeoRazorX · reported by GitHubMedium 5.3
FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-27964 · Other software · NeoRazorX · reported by GitHubLow 3.9
FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-27892 · Other software · NeoRazorX · reported by GitHubMedium 6.5
FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could extract the uploader's embedded metadata, which included GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata. Of all FacturaScripts' image upload features, only the Library module combined unrestricted uploads, persistent storage, authenticated download access, and a total lack of server-side metadata sanitization. This vulnerability carries significant real-world impact: an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access. This issue has been fixed in version 2026.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-27891 · Other software · NeoRazorX · reported by GitHubHigh 7.2
FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. The vulnerability is located in Plugins.php. While the testZipFile function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. An attacker can bypass this check by naming a file ValidPluginName/../../shell.php. The explode function will see ValidPluginName as the root folder, satisfying the count($folders) != 1 check. However, during extraction, the ../../ sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory. This issue is fixed in version 2026.1.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026FacturaScripts is an open source accounting and invoicing software.CVE-2026-32699 · Other software · NeoRazorX · reported by GitHubMedium 5.3
FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-25514 · Other software · NeoRazorX · reported by GitHubHigh 8.7
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-25513 · Other software · NeoRazorX · reported by GitHubHigh 8.3
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-23997 · Other software · NeoRazorX · reported by GitHubHigh 8
FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2026-23476 · Other software · NeoRazorX · reported by GitHubMedium 5.4
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025FacturaScripts is open-source enterprise resource planning and accounting software.CVE-2025-69210 · Other software · NeoRazorX · reported by GitHubLow 1.2
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.
- Product
- facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacturascripts.comgithub.com
Jun 13, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.CVE-2022-2066 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.CVE-2022-2065 · Other software · neorazorx · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.CVE-2022-2016 · Other software · neorazorx · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2022Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.CVE-2022-1988 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-1715 · Other software · neorazorx · reported by security@huntr.devCritical 9.8
Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-1682 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-1571 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06.CVE-2022-1514 · Other software · neorazorx · reported by security@huntr.devMedium 5.4
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04.CVE-2022-1457 · Other software · neorazorx · reported by security@huntr.devMedium 5.4
Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.