CVE-2025-69210

🗓️ 30 Dec 2025 19:23:31Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 7 Views🌐 WEB

FacturaScripts pre-2025.7 stores XSS via XML uploads, enabling JavaScript in admin sessions.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2025-69210	30 Dec 202522:32	–	circl
CNNVD	FacturaScripts 跨站脚本漏洞	30 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-69210 FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload	30 Dec 202519:23	–	cvelist
Exploit DB	FacturaScripts 2025.43 - XSS	29 Apr 202600:00	–	exploitdb
EUVD	EUVD-2025-205844	30 Dec 202520:52	–	euvd
Github Security Blog	FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload	30 Dec 202520:52	–	github
NVD	CVE-2025-69210	30 Dec 202520:16	–	nvd
OSV	CVE-2025-69210 FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload	30 Dec 202519:23	–	osv
OSV	GHSA-2267-XQCF-GW2M FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload	30 Dec 202520:52	–	osv
Packet Storm	📄 FacturaScripts 2025.43 Cross Site Scripting	5 May 202600:00	–	packetstorm

NVD

Vulners

Node

facturascripts facturascriptsRange<2025.7

[
  {
    "vendor": "NeoRazorX",
    "product": "facturascripts",
    "versions": [
      {
        "version": "< 2025.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/NeoRazorX/facturascripts/releases/tag/v2025.7
github	www.github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2267-xqcf-gw2m
facturascripts	www.facturascripts.com/publicaciones/ya-disponible-facturascripts-2025-7

Parameter	Position	Path	Description	CWE
new-files[]	request body	EditProducto?code=10	Stored XSS via uploaded XML file in product file upload	CWE-79
myft	path	MyFiles/2025/12/9.xml	Uploaded file accessed via URL leading to XSS payload execution in admin/session context	CWE-79

23 Feb 2026 15:23Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.4

CVSS 45.1

EPSS0.00019

SSVC

CWE-79