CVE-2026-42877

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42877", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-30T18:49:06.711Z", "datePublished": "2026-05-27T18:37:06.291Z", "dateUpdated": "2026-05-28T15:15:20.904Z"}, "containers": {"cna": {"title": "FacturaScripts: Stored XSS via product reference in sales/purchases", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx"}], "affected": [{"vendor": "NeoRazorX", "product": "facturascripts", "versions": [{"version": "<= 2025.92", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T18:37:06.291Z"}, "descriptions": [{"lang": "en", "value": "FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note."}], "source": {"advisory": "GHSA-r736-2678-fcrx", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T15:13:50.730745Z", "id": "CVE-2026-42877", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T15:15:20.904Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42877", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T15:13:50.730745Z"}}}], "references": [{"url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T15:14:06.784Z"}}], "cna": {"title": "FacturaScripts: Stored XSS via product reference in sales/purchases", "source": {"advisory": "GHSA-r736-2678-fcrx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "NeoRazorX", "product": "facturascripts", "versions": [{"status": "affected", "version": "<= 2025.92"}]}], "references": [{"url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx", "name": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T18:37:06.291Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42877", "state": "PUBLISHED", "dateUpdated": "2026-05-28T15:15:20.904Z", "dateReserved": "2026-04-30T18:49:06.711Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T18:37:06.291Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "facturascripts", "vendor": "NeoRazorX", "versions": [{"status": "affected", "version": "<= 2025.92"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note."}, {"lang": "es", "value": "FacturaScripts es un software de contabilidad y facturaci\u00f3n de c\u00f3digo abierto. En la versi\u00f3n 2025.92 y anteriores, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en el modal de b\u00fasqueda de productos de documentos de ventas (Core/Lib/AjaxForms/SalesModalHTML.php) y compras (Core/Lib/AjaxForms/PurchasesModalHTML.php). Un usuario autenticado con acceso al m\u00f3dulo de almac\u00e9n puede crear un producto con una referencia maliciosa que ejecuta JavaScript arbitrario en el navegador de cualquier otro usuario que abra el modal de b\u00fasqueda de productos dentro de una factura, pedido o albar\u00e1n."}], "id": "CVE-2026-42877", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42877", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-28T15:13:50.730745Z", "version": "2.0.3"}}]}, "published": "2026-05-27T20:16:36.673", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025.92]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "facturascripts", "source": "cna", "vendor": "NeoRazorX"}, "product": "facturascripts", "vendor": "neorazorx"}], "created": "2026-05-27T22:00:18.000445+00:00", "updated": "2026-05-28T04:15:06.710958+00:00", "vendors": ["neorazorx", "neorazorx$PRODUCT$facturascripts"]}