CVE-2026-45263

«Live PoC verified 2026-04-30 against a stock FacturaScripts master at "127.0.0.1:8081". A low-privilege user "lowpriv" created a customer with "nombre = "=SUM1+1cmd|/c calc!A1"". An admin then exported "ListCliente" to CSV via "?action=export&option=CSV". The downloaded file contains the raw...