Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

facturascripts — Vulnerabilities & Security Advisories 12

All 12 CVE vulnerabilities found in facturascripts, with AI-generated Chinese analysis, references, and POCs.

Vendor: NeoRazorX

CVE IDTitleCVSSSeverityPublished
CVE-2026-42877 FacturaScripts: Stored XSS via product reference in sales/purchases CWE-79 5.4 Medium2026-05-27
CVE-2026-42879 FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images CWE-94 6.3 Medium2026-05-27
CVE-2026-42878 FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts CWE-200 5.3 Medium2026-05-27
CVE-2026-27964 FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation CWE-79 3.9 Low2026-05-18
CVE-2026-27892 FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download CWE-200 6.5 Medium2026-05-18
CVE-2026-27891 Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism CWE-20 7.2 High2026-05-18
CVE-2026-32699 FacturaScripts unauthorized modification of immutable nick field via EditUser controller CWE-472 4.3 -2026-05-05
CVE-2026-25513 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause CWE-89 8.8AIHighAI2026-02-04
CVE-2026-25514 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions CWE-20 6.5AIMediumAI2026-02-04
CVE-2026-23476 FacturaScripts Affected by Reflected XSS CWE-79 5.4 Medium2026-02-02
CVE-2026-23997 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View CWE-79 8.0 High2026-02-02
CVE-2025-69210 FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload CWE-79 5.4 -2025-12-30

All 12 known CVE vulnerabilities affecting facturascripts with full Chinese analysis, references, and POCs where available.