CVE-2026-45710

"WidgetVariante::renderVariantList" "Core/Lib/Widget/WidgetVariante.php:298-330" and "WidgetSubcuenta::renderSubaccountList" "Core/Lib/Widget/WidgetSubcuenta.php:290-321" build the "" row for each modal hit by concatenating the user-controlled "referencia" / "codsubcuenta" field directly into a...

Cross-site scripting - Reflected in Create Subaccount

Description Cross-site scripting - Reflected in Create Subaccount via codsubcuenta parameter. Proof of Concept POST /facturascripts/EditSubcuenta HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:100.0 Gecko/20100101 Firefox/100.0 Accept:...