CVE-2026-2679

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2679", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2026-02-18T11:25:13.322Z", "datePublished": "2026-02-26T12:18:13.402Z", "dateUpdated": "2026-02-26T14:06:26.035Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "A3factura", "vendor": "A3factura", "versions": [{"status": "affected", "version": "4.111.2-rev.1"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:a3factura:a3factura:4.111.2-rev.1:*:*:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "David Padilla Alvarado"}], "datePublic": "2026-02-26T12:12:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser."}], "value": "Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint,\u00a0which could allow an attacker to execute arbitrary code in the victim's browser."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 4.8, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-02-26T12:18:13.402Z"}, "references": [{"tags": ["patch"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-a3factura-software"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The fix has been deployed in production in version 4.114.0-rev.6, released on 17/02/2026."}], "value": "The fix has been deployed in production in version 4.114.0-rev.6, released on 17/02/2026."}], "source": {"discovery": "EXTERNAL"}, "title": "Multiple vulnerabilities in A3factura software", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T14:05:20.492909Z", "id": "CVE-2026-2679", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:06:26.035Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2679", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T14:05:20.492909Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:05:36.926Z"}}], "cna": {"title": "Multiple vulnerabilities in A3factura software", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "David Padilla Alvarado"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "A3factura", "product": "A3factura", "versions": [{"status": "affected", "version": "4.111.2-rev.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The fix has been deployed in production in version 4.114.0-rev.6, released on 17/02/2026.", "supportingMedia": [{"type": "text/html", "value": "The fix has been deployed in production in version 4.114.0-rev.6, released on 17/02/2026.", "base64": false}]}], "datePublic": "2026-02-26T12:12:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-a3factura-software", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint,\u00a0which could allow an attacker to execute arbitrary code in the victim's browser.", "supportingMedia": [{"type": "text/html", "value": "Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:a3factura:a3factura:4.111.2-rev.1:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-02-26T12:18:13.402Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2679", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:06:26.035Z", "dateReserved": "2026-02-18T11:25:13.322Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2026-02-26T12:18:13.402Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "A3factura", "vendor": "A3factura", "versions": [{"status": "affected", "version": "4.111.2-rev.1"}]}], "source": "cve-coordination@incibe.es"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wolterskluwer:a3factura:4.111.2:rev.1:*:*:*:*:*:*", "matchCriteriaId": "463E4777-35F8-4E5F-80BD-790CE98A2975", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint,\u00a0which could allow an attacker to execute arbitrary code in the victim's browser."}, {"lang": "es", "value": "Cross-Site Scripting Reflejado (XSS) en la plataforma web A3factura, en el par\u00e1metro 'customerName', en el endpoint 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices', lo que podr\u00eda permitir a un atacante ejecutar c\u00f3digo arbitrario en el navegador de la v\u00edctima."}], "id": "CVE-2026-2679", "lastModified": "2026-06-17T10:31:31.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@incibe.es", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2679", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T14:05:20.492909Z", "version": "2.0.3"}}]}, "published": "2026-02-26T13:16:17.080", "references": [{"source": "cve-coordination@incibe.es", "tags": ["Third Party Advisory"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-a3factura-software"}], "sourceIdentifier": "cve-coordination@incibe.es", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve-coordination@incibe.es", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.111.2-rev.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "A3factura", "source": "cna", "vendor": "A3factura"}, "product": "a3factura", "vendor": "a3factura"}], "analysis": {"en": {"generated_at": "2026-04-18T10:23:15.065536+00:00", "value": {"mitigation_remediation": ["Upgrade A3factura to version 4.114.0\u2011rev.6, which contains the necessary patch.", "Deploy a Content Security Policy that restricts the sources of executable scripts to mitigate reflected XSS until the update is applied.", "Apply proper output encoding or input validation on the \u2018customerName\u2019 parameter and any other user\u2011supplied data to prevent characters from being treated as executable code."], "summary": {"action": "Apply Patch", "impact": "Client\u2011side code execution via Reflective XSS"}, "threat_synthesis": {"affected_systems": "The affected product is A3factura version 4.111.2\u2011rev.1, released by A3factura and its partner Wolters\u202fKluwer. A security fix was deployed in version 4.114.0\u2011rev.6 on 17\u202fFeb\u202f2026. Users running any earlier releases remain vulnerable.", "description_and_impact": "A3factura\u2019s web platform contains a reflected Cross\u2011Site Scripting flaw that appears when a malicious value is supplied in the \u2018customerName\u2019 parameter on the /incomes/salesInvoices endpoint. Because the input is echoed back without proper encoding, a crafted request can cause the victim\u2019s browser to execute arbitrary JavaScript. This vulnerability enables an attacker to run code within the victim\u2019s session but does not affect the server directly.", "risk_and_exploitability": "The CVSS score of 4.8 classifies the flaw as moderate, while the EPSS score of <\u00a01\u202f% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to entice a victim to click a crafted link or submit a form that injects a malicious \u2018customerName\u2019 value; the attack is limited to the victim\u2019s browser and does not facilitate higher\u2011level compromise or server\u2011side damage."}}}}, "created": "2026-02-27T09:07:33.133618+00:00", "updated": "2026-04-18T10:30:35.762669+00:00", "vendors": ["a3factura", "a3factura$PRODUCT$a3factura"]}