CVE-2025-69210

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-69210", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T14:59:45.106Z", "datePublished": "2025-12-30T19:23:31.130Z", "dateUpdated": "2025-12-30T19:47:52.458Z"}, "containers": {"cna": {"title": "FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 1.2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2267-xqcf-gw2m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2267-xqcf-gw2m"}, {"name": "https://facturascripts.com/publicaciones/ya-disponible-facturascripts-2025-7", "tags": ["x_refsource_MISC"], "url": "https://facturascripts.com/publicaciones/ya-disponible-facturascripts-2025-7"}, {"name": "https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.7"}], "affected": [{"vendor": "NeoRazorX", "product": "facturascripts", "versions": [{"version": "< 2025.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-30T19:23:31.130Z"}, "descriptions": [{"lang": "en", "value": "FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator\u2019s browser session. Version 2025.7 fixes the issue."}], "source": {"advisory": "GHSA-2267-xqcf-gw2m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-30T19:47:41.304934Z", "id": "CVE-2025-69210", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-30T19:47:52.458Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-69210", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-30T19:47:41.304934Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-30T19:47:45.943Z"}}], "cna": {"title": "FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload", "source": {"advisory": "GHSA-2267-xqcf-gw2m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "NeoRazorX", "product": "facturascripts", "versions": [{"status": "affected", "version": "< 2025.7"}]}], "references": [{"url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2267-xqcf-gw2m", "name": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2267-xqcf-gw2m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://facturascripts.com/publicaciones/ya-disponible-facturascripts-2025-7", "name": "https://facturascripts.com/publicaciones/ya-disponible-facturascripts-2025-7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.7", "name": "https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator\u2019s browser session. Version 2025.7 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-30T19:23:31.130Z"}}}, "cveMetadata": {"cveId": "CVE-2025-69210", "state": "PUBLISHED", "dateUpdated": "2025-12-30T19:47:52.458Z", "dateReserved": "2025-12-29T14:59:45.106Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-30T19:23:31.130Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "facturascripts", "vendor": "NeoRazorX", "versions": [{"status": "affected", "version": "< 2025.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEEE032D-0FA6-4BA9-806E-71BB06FB8729", "versionEndExcluding": "2025.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator\u2019s browser session. Version 2025.7 fixes the issue."}, {"lang": "es", "value": "FacturaScripts es un software de c\u00f3digo abierto de planificaci\u00f3n de recursos empresariales y contabilidad. Antes de la versi\u00f3n 2025.7, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la funcionalidad de carga de archivos del producto. Usuarios autenticados pueden cargar archivos XML manipulados que contienen JavaScript ejecutable. Estos archivos son posteriormente renderizados por la aplicaci\u00f3n sin suficiente saneamiento o aplicaci\u00f3n del tipo de contenido, permitiendo la ejecuci\u00f3n arbitraria de JavaScript cuando se accede al archivo. Debido a que los archivos del producto cargados por usuarios regulares son visibles para los usuarios administrativos, esta vulnerabilidad puede ser aprovechada para ejecutar JavaScript malicioso en la sesi\u00f3n del navegador de un administrador. La versi\u00f3n 2025.7 corrige el problema."}], "id": "CVE-2025-69210", "lastModified": "2026-06-17T10:00:17.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.2, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69210", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-30T19:47:41.304934Z", "version": "2.0.3"}}]}, "published": "2025-12-30T20:16:01.697", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://facturascripts.com/publicaciones/ya-disponible-facturascripts-2025-7"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/NeoRazorX/facturascripts/releases/tag/v2025.7"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2267-xqcf-gw2m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2026-01-05T10:19:22.418487+00:00", "updated": "2026-01-05T10:19:22.418524+00:00", "vendors": ["facturascripts", "facturascripts$PRODUCT$facturascripts"]}