facturascripts/facturascripts vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-HGJX-R89M-M7V4Criticalfacturascripts/facturascripts: FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCECVE-2026-45710Lowfacturascripts/facturascripts: FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes…CVE-2026-45263Highfacturascripts/facturascripts: FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens…CVE-2026-45693Highfacturascripts/facturascripts: FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles DocumentsCVE-2026-45262Criticalfacturascripts/facturascripts: FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`CVE-2026-47677Criticalfacturascripts/facturascripts: FacturaScripts: Account takeover of any 2FA-enabled userCVE-2026-42879Mediumfacturascripts/facturascripts: FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product ImagesCVE-2026-42878Mediumfacturascripts/facturascripts: FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer EndpointCVE-2026-42877Mediumfacturascripts/facturascripts: FacturaScripts vulnerable to stored XSS via product reference in sales/purchasesCVE-2026-27964Lowfacturascripts/facturascripts: FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie ManipulationCVE-2026-27892Mediumfacturascripts/facturascripts: FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/DownloadCVE-2026-27891Highfacturascripts/facturascripts: FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismCVE-2026-32699Mediumfacturascripts/facturascripts: FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' FieldCVE-2026-25514Highfacturascripts/facturascripts: FacturaScripts has SQL Injection in Autocomplete ActionsCVE-2026-25513Highfacturascripts/facturascripts: FacturaScripts has SQL Injection in API ORDER BY ClauseCVE-2026-23997Highfacturascripts/facturascripts: FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History ViewCVE-2026-23476Mediumfacturascripts/facturascripts: FacturaScripts is Vulnerable to Reflected XSSCVE-2025-69210Highfacturascripts/facturascripts: FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File UploadCVE-2022-2066Mediumfacturascripts/facturascripts: Cross site scripting in facturascriptsCVE-2022-2065Mediumfacturascripts/facturascripts: Cross-site Scripting in FacturaScriptsCVE-2022-2016Mediumfacturascripts/facturascripts: Cross-site Scripting in FacturaScriptsCVE-2022-1988Mediumfacturascripts/facturascripts: Cross-site Scripting in FacturaScriptsCVE-2022-1715Criticalfacturascripts/facturascripts: Account takeover in facturascriptsCVE-2022-1682Mediumfacturascripts/facturascripts: Cross-site Scripting in facturascriptsCVE-2022-1571Mediumfacturascripts/facturascripts: Cross-site Scripting in FacturaScripts

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo