CVE-2025-69210 FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting XSS vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These...

PT-2025-54222

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting XSS vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These...

FacturaScripts 跨站脚本漏洞

FacturaScripts is an open source ERP software from Carlos Garcia, an individual developer in Spain. A cross-site scripting vulnerability exists in FacturaScripts versions prior to 2025.7, which stems from insufficient product file upload feature cleanup and content type coercion, and could lead t...

EUVD-2022-6144

Malicious code in bioql PyPI...

EUVD-2022-6064

Malicious code in bioql PyPI...

EUVD-2022-6076

Malicious code in bioql PyPI...

EUVD-2022-6039

Malicious code in bioql PyPI...

EUVD-2022-5372

Malicious code in bioql PyPI...

EUVD-2022-2709

Malicious code in bioql PyPI...

CVE-2022-1988

Cross-site Scripting XSS - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09...

CVE-2022-2016

Cross-site Scripting XSS - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1...

CVE-2022-1457

Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the...

CVE-2022-1514

Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine...

CVE-2022-1715

Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07...

CVE-2022-1571

Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of same origin page, etc...

CVE-2022-2065

Cross-site Scripting XSS - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06...

CVE-2022-2066

Cross-site Scripting XSS - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06...

Stored XSS in EditEstadoDocumento

Description In facturascripts/EditEstadoDocumento, the field Icon can be injected an XSS payload into it. Proof of Concept // PoC.js POST /facturascripts/EditEstadoDocumento?code=27&action=save-ok HTTP/1.1 Host: 127.0.0.1 Content-Length: 1224 Cache-Control: max-age=0 sec-ch-ua:...

FacturaScripts Cross-Site Scripting Vulnerability (CNVD-2022-59043)

FacturaScripts is an ERP software. A cross-site scripting vulnerability exists in versions prior to facturascripts 2022.06, which stems from a lack of filename validation, and can be exploited by an attacker to upload a svg file resulting in a cross-site scripting attack...

FacturaScripts Cross-Site Scripting Vulnerability

FacturaScripts is an ERP software. A cross-site scripting vulnerability exists in FacturaScripts versions prior to 2022.06, which can be exploited by an attacker to execute JavaScript code on the client side...