FacturaScripts vulnerabilities
4 known CVE vulnerabilities in FacturaScripts, translated and rated.
- CVE-2026-27964Low
FacturaScripts up to version 2025.7 has a Reflected XSS vulnerability via the fsNick cookie parameter. The cookie value is reflected in HTML without sanitization, allowing script execution before redirect. Fixed in version 2025.8.
- CVE-2026-27892Medium
FacturaScripts before version 2026 stores and serves uploaded images without stripping EXIF/XMP/IPTC metadata. Authenticated users can download an image and extract the uploader's personal data such as GPS coordinates, device information, and timestamps.
- CVE-2026-27891High
FacturaScripts versions 2026 and below contain a critical vulnerability in the Plugins::add() function that fails to properly validate file paths within uploaded ZIP archives. This allows a Zip Slip attack, leading to arbitrary file write and remote code execution (RCE) by overwriting sensitive .php files outside the plugins directory.
- CVE-2026-32699Medium
FacturaScripts up to version 2025.92 fails to validate the 'nick' parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, an attacker can intercept the request and modify the parameter to rename any account, including the administrator.