PT-2026-38612 · Neorazorx+1 · Facturascripts+1

Published 2026-05-07 · Updated 2026-05-19 · CVE-2026-27964

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2025.8

Description A Reflected Cross-Site Scripting (XSS) issue exists where the application reflects the value of the fsNick cookie parameter directly into the HTML without sanitization or encoding into the Document Object Model (DOM). Although the server rejects the modified session and forces a logout, the HTML containing the payload reaches the browser first, allowing the script to execute immediately upon load and bypass the redirect.

Recommendations Update to version 2025.8. As a temporary workaround, restrict or sanitize the use of the fsNick cookie parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27964

GHSA-GQ5C-RW37-G46C

Affected Products

Facturascripts

Facturascripts/Facturascripts

References · 10

• 🔥 https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-gq5c-rw37-g46c · Exploit
• https://osv.dev/vulnerability/GHSA-gq5c-rw37-g46c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27964 · Security Note
• https://github.com/NeoRazorX/facturascripts/commit/9066e10326029adf012114e27eb5f3f33f78ecfd · Note
• https://github.com/NeoRazorX/facturascripts · Note
• https://twitter.com/VulmonFeeds/status/2056522645659660500 · Twitter Post
• https://twitter.com/CVEnew/status/2056670118537732445 · Twitter Post
• https://t.me/CVEtracker/54178 · Telegram Post
• https://twitter.com/infoflowcloud/status/2056671517371506808 · Twitter Post
• https://t.me/cveNotify/163938 · Telegram Post