Security
فارسی
All products

facturascripts/facturascripts

Composer · Package
26 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`CVE-2026-45710 · GHSA-3X7P-V8HJ-XH5M facturascripts/facturascripts Composer Low Fix reported
FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCECVE-2026-77526 · GHSA-HGJX-R89M-M7V4 facturascripts/facturascripts Composer Critical Fix reported
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the exportCVE-2026-45263 · GHSA-2P5X-4JR6-X5JG facturascripts/facturascripts Composer High Fix reported
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`CVE-2026-45262 · GHSA-5QMH-X653-G8QJ facturascripts/facturascripts Composer Critical Fix reported
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/DownloadCVE-2026-27892 · GHSA-Q7F2-RV22-2XGR facturascripts/facturascripts Composer Medium Fix reported
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie ManipulationCVE-2026-27964 · GHSA-GQ5C-RW37-G46C facturascripts/facturascripts Composer Low Fix reported
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer EndpointCVE-2026-42878 · GHSA-VRXF-VRC4-22P7 facturascripts/facturascripts Composer Medium No fix reported
FacturaScripts vulnerable to stored XSS via product reference in sales/purchasesCVE-2026-42877 · GHSA-R736-2678-FCRX facturascripts/facturascripts Composer Medium No fix reported
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product ImagesCVE-2026-42879 · GHSA-VF3Q-FRMR-VRR9 facturascripts/facturascripts Composer Medium No fix reported
FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles DocumentsCVE-2026-45693 · GHSA-CV65-7CG8-R623 facturascripts/facturascripts Composer High No fix reported
FacturaScripts: Account takeover of any 2FA-enabled userCVE-2026-47677 · GHSA-C67F-GMXW-MJ93 facturascripts/facturascripts Composer Critical Fix reported
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismCVE-2026-27891 · GHSA-3PGC-XQG9-CFR6 facturascripts/facturascripts Composer High No fix reported
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' FieldCVE-2026-32699 · GHSA-PP79-HQV6-VMC3 facturascripts/facturascripts Composer Medium No fix reported
FacturaScripts has SQL Injection in API ORDER BY ClauseCVE-2026-25513 · GHSA-CJFX-QHWM-HF99 facturascripts/facturascripts Composer High Fix reported
FacturaScripts has SQL Injection in Autocomplete ActionsCVE-2026-25514 · GHSA-PQQG-5F4F-8952 facturascripts/facturascripts Composer High Fix reported
FacturaScripts is Vulnerable to Reflected XSSCVE-2026-23476 · GHSA-G6W2-Q45F-XRP4 facturascripts/facturascripts Composer Medium Fix reported
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History ViewCVE-2026-23997 · GHSA-4V7V-7V7R-3R5H facturascripts/facturascripts Composer High No fix reported
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File UploadCVE-2025-69210 · GHSA-2267-XQCF-GW2M facturascripts/facturascripts Composer High Fix reported
Cross site scripting in facturascriptsCVE-2022-2066 · GHSA-H6WM-MR85-4H9G facturascripts/facturascripts Composer Medium Fix reported
Cross-site Scripting in FacturaScriptsCVE-2022-2065 · GHSA-FP76-F299-V3HJ facturascripts/facturascripts Composer Medium Fix reported