CVE-2026-27964— FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-27964
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
Source: NVD (National Vulnerability Database)
Vulnerability Description
FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NeoRazorX | facturascripts | < 2025.8 | - |
II. Public POCs for CVE-2026-27964
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-27964
请登录查看更多情报信息。
Same Patch Batch · NeoRazorX · 2026-05-18 · 3 CVEs total
| CVE-2026-27891 | 7.2 HIGH | Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism |
| CVE-2026-27892 | 6.5 MEDIUM | FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Do |
IV. Related Vulnerabilities
Same product: facturascripts
- CVE-2026-27892
FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via - CVE-2026-27891
Remote Code Execution (RCE) via Zip Slip in Plugin Upload Me - CVE-2026-32699
FacturaScripts unauthorized modification of immutable nick f - CVE-2026-25513
FacturaScripts has SQL Injection vulnerability in API ORDER - CVE-2026-25514
FacturaScripts has SQL Injection vulnerability in Autocomple
Same vendor: NeoRazorX
- CVE-2026-27892
FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via - CVE-2026-27891
Remote Code Execution (RCE) via Zip Slip in Plugin Upload Me - CVE-2026-32699
FacturaScripts unauthorized modification of immutable nick f - CVE-2026-25513
FacturaScripts has SQL Injection vulnerability in API ORDER - CVE-2026-25514
FacturaScripts has SQL Injection vulnerability in Autocomple
Same weakness: CWE-79
- CVE-2026-27737
BigBlueButton has Stored XSS in bbb-playback replay - CVE-2026-45231
DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fiel - CVE-2026-45494
Microsoft Edge (Chromium-based) Spoofing Vulnerability - CVE-2026-7498
Stored XSS in Basamak Informatics' DernekWeb - CVE-2026-3495
Unescaped variables during error page composition
V. Comments for CVE-2026-27964
No comments yet