CVE Feed

    Dashboard / CVE / CVE-2026-23476

    CVE-2026-23476

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

    Published:Feb 2, 2026
    Last Modified:Apr 18, 2026
    EPS:Feb 2, 2026
    EPSS Score:0.00016
    CVSS Score:5.4

    Affected Products

    Vendor
    Facturascripts
    Product
    Facturascripts
    Vendor
    Neorazorx
    Product
    Facturascripts

    Exploits

    https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-g6w2-q45f-xrp4

    Related CVEs

    CVE-2026-25513 (CVSS 8.3) — FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, …
    CVE-2026-25514 (CVSS 8.7) — FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, …
    CVE-2026-23997 (CVSS 8) — FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a …
    CVE-2025-69210 (CVSS 1.2) — FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a…
    CVE-2022-2066 (CVSS 6.1) — Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.…
    CVE-2022-2065 (CVSS 5.4) — Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.…
    CVE-2022-2016 (CVSS 5.4) — Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.…
    CVE-2022-1988 (CVSS 6.1) — Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.…
    CVE-2022-1715 (CVSS 9.8) — Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.…
    CVE-2022-1682 (CVSS 6.1) — Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High