CVE-2026-23997

The record

FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.

Affected packages

Related vulnerabilities

• GHSA-4v7v-7v7r-3r5h FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History… Same vulnerability
• CVE-2026-25514 FacturaScripts is open-source enterprise resource planning and accounting software. Also affects facturascripts/facturascripts
• CVE-2026-25513 FacturaScripts is open-source enterprise resource planning and accounting software. Also affects facturascripts/facturascripts
• GHSA-pqqg-5f4f-8952 FacturaScripts has SQL Injection in Autocomplete Actions Also affects facturascripts/facturascripts
• GHSA-cjfx-qhwm-hf99 FacturaScripts has SQL Injection in API ORDER BY Clause Also affects facturascripts/facturascripts
• CVE-2026-23476 FacturaScripts is open-source enterprise resource planning and accounting software. Also affects facturascripts/facturascripts
• GHSA-g6w2-q45f-xrp4 FacturaScripts is Vulnerable to Reflected XSS Also affects facturascripts/facturascripts
• GHSA-2267-xqcf-gw2m FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload Also affects facturascripts/facturascripts