CVE-2026-23997

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23997", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T18:49:20.658Z", "datePublished": "2026-02-02T20:19:45.182Z", "dateUpdated": "2026-02-03T15:06:30.329Z"}, "containers": {"cna": {"title": "FacturaScripts has a Stored Cross-Site Scripting (XSS) in \"Observations\" field via History View", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-4v7v-7v7r-3r5h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-4v7v-7v7r-3r5h"}], "affected": [{"vendor": "NeoRazorX", "product": "facturascripts", "versions": [{"version": "<= 2025.71", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T20:19:45.182Z"}, "descriptions": [{"lang": "en", "value": "FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators."}], "source": {"advisory": "GHSA-4v7v-7v7r-3r5h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T15:06:16.299874Z", "id": "CVE-2026-23997", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:06:30.329Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23997", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-03T15:06:16.299874Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:06:25.861Z"}}], "cna": {"title": "FacturaScripts has a Stored Cross-Site Scripting (XSS) in \"Observations\" field via History View", "source": {"advisory": "GHSA-4v7v-7v7r-3r5h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "NeoRazorX", "product": "facturascripts", "versions": [{"status": "affected", "version": "<= 2025.71"}]}], "references": [{"url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-4v7v-7v7r-3r5h", "name": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-4v7v-7v7r-3r5h", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T20:19:45.182Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23997", "state": "PUBLISHED", "dateUpdated": "2026-02-03T15:06:30.329Z", "dateReserved": "2026-01-19T18:49:20.658Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-02T20:19:45.182Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "facturascripts", "vendor": "NeoRazorX", "versions": [{"status": "affected", "version": "<= 2025.71"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4341C53-B996-439F-AE9E-42249F2A0D4E", "versionEndExcluding": "2025.71", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators."}, {"lang": "es", "value": "FacturaScripts es un software de planificaci\u00f3n de recursos empresariales y contabilidad de c\u00f3digo abierto. En la versi\u00f3n 2025.71 y anteriores, se descubri\u00f3 una vulnerabilidad de cross-site scripting (XSS) almacenado en el campo Observaciones. La falla ocurre en la vista Historial, donde los datos hist\u00f3ricos se renderizan sin la codificaci\u00f3n adecuada de entidades HTML. Esto permite a un atacante ejecutar JavaScript arbitrario en el navegador de los administradores que visualizan el historial."}], "id": "CVE-2026-23997", "lastModified": "2026-06-17T10:22:27.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23997", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T15:06:16.299874Z", "version": "2.0.3"}}]}, "published": "2026-02-02T23:16:07.347", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-4v7v-7v7r-3r5h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:33:19.546167+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest FacturaScripts release that omits the issue (versions newer than 2025.71).", "Implement proper input validation and HTML entity encoding for all data displayed in the History view to neutralize any stored scripts.", "Restrict the History view to administrator accounts only, ensuring that only trusted users can access potentially vulnerable content."], "summary": {"action": "Patch immediately", "impact": "Cross\u2011Site Scripting allowing arbitrary JavaScript to run in the browsers of administrators viewing invoice history"}, "threat_synthesis": {"affected_systems": "The software affected is FacturaScripts, produced by NeoRazorX, specifically versions 2025.71 and earlier. Upgrading beyond 2025.71 removes the flaw.\n", "description_and_impact": "A stored Cross\u2011Site Scripting flaw is present in the Observations field of the History view. Historical data is rendered without proper HTML entity encoding, enabling an attacker to insert malicious JavaScript that executes when an administrator opens the history screen. The immediate effect is the ability to run code in the context of the administrator\u2019s browser, which can lead to session hijacking, data exfiltration, or further compromise of the application. The vulnerability directly affects the confidentiality, integrity, and availability of managerial data and the user session.\n", "risk_and_exploitability": "The CVSS score of 8 categorizes this vulnerability as high severity; the EPSS score is under 1%, indicating a low probability of exploitation at present. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers need to inject code into the Observations field to place the payload, which likely requires user privileges that allow adding or editing history entries. Once the payload is stored, any administrator who views the history will have their browser's script engine execute the injected code. The primary attack vector is the web application interface, with precedence on successful authentication and permission to view history.\n"}}}}, "created": "2026-02-04T12:17:54.494359+00:00", "updated": "2026-04-18T00:45:32.231790+00:00", "vendors": ["facturascripts", "facturascripts$PRODUCT$facturascripts", "neorazorx", "neorazorx$PRODUCT$facturascripts"]}