PT-2026-5712 · Unknown+1 · Facturascripts+1

H4Cd0C · Published 2026-02-02 · Updated 2026-02-23 · CVE-2026-23476

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2025.8

Description FacturaScripts is susceptible to a reflected cross-site scripting (XSS) issue stemming from improper handling of error messages. The application utilizes Twig's | raw filter, which bypasses HTML escaping. When a database error occurs—such as providing a string where an integer is expected—the resulting error message, including the input, is rendered without sanitization. This allows attackers to inject malicious scripts into the error message, potentially leading to credential phishing or other attacks. The vulnerability exists in the Core/View/Macro/Utils.html.twig file, specifically on line 27. The issue is triggered by sending crafted input through parameters like code in API endpoints such as /EditProducto?code=, /EditCliente?code=, /EditFacturaCliente?code=, and /EditProveedor?code=. The error logging occurs in Core/Base/DataBase.php around line 236. Attackers can leverage this to steal credentials by injecting a fake login form, read page data, or potentially execute keyloggers and bypass CSRF protections.

Recommendations Versions prior to 2025.8: Remove | raw from line 27 in Core/View/Macro/Utils.html.twig.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23476

GHSA-G6W2-Q45F-XRP4

Affected Products

Facturascripts

Twig

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23476.json · Exploit
• https://github.com/NeoRazorX/facturascripts/commit/2afd98cecd26c5f8357e0e321d86063ad1012fc3 · Patch
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-g6w2-q45f-xrp4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23476 · Security Note
• https://osv.dev/vulnerability/GHSA-g6w2-q45f-xrp4 · Vendor Advisory
• https://github.com/NeoRazorX/facturascripts · Note
• https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.8 · Note
• https://twitter.com/VulmonFeeds/status/2018512448483979584 · Twitter Post
• https://twitter.com/CVEnew/status/2018465527849500806 · Twitter Post
• https://t.me/cveNotify/152873 · Telegram Post