CVE-2026-11959: Multiple vulnerabilities in FacturaScripts
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FacturaScriptsto a version that resolves this vulnerability.Patch aa728f642b467bb73bf183067912bd97536d06a6
Event History
Frequently Asked Questions
Who is most directly exposed to this issue?
Application users whose browsers render attacker-controlled values stored in the city or province fields are exposed. A normal user may be able to use the resulting script execution to escalate privileges to an administrator.
What does an attacker need to exploit it?
The attacker needs to place specially crafted JavaScript in the city or province fields handled by the ListAlmacen endpoint and have an application user’s browser execute the stored content.
Do httpOnly cookies prevent the reported session impact?
No. The reported impact includes extracting CSRF tokens, which can allow session hijacking or other actions even when cookies are marked httpOnly.