Critical
ghsa-hgjx-r89m-m7v4
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 26
Reset filters
Low
CVE-2026-45710
FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`
High
CVE-2026-45263
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
High
CVE-2026-45693
FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents
Critical
CVE-2026-45262
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
Critical
CVE-2026-47677
FacturaScripts: Account takeover of any 2FA-enabled user
Medium
CVE-2026-42879
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
Medium
CVE-2026-42878
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint
Medium
CVE-2026-42877
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases
Low
CVE-2026-27964
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
Medium
CVE-2026-27892
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
High
CVE-2026-27891
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
Medium
CVE-2026-32699
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field
High
CVE-2026-25514
FacturaScripts has SQL Injection in Autocomplete Actions
High
CVE-2026-25513
FacturaScripts has SQL Injection in API ORDER BY Clause
High
CVE-2026-23997
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View
Medium
CVE-2026-23476
FacturaScripts is Vulnerable to Reflected XSS
High
CVE-2025-69210
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
Medium
CVE-2022-2066
Cross site scripting in facturascripts
Medium
CVE-2022-2065
Cross-site Scripting in FacturaScripts
Medium
CVE-2022-2016
Cross-site Scripting in FacturaScripts
Medium
CVE-2022-1988
Cross-site Scripting in FacturaScripts
Critical
CVE-2022-1715
Account takeover in facturascripts
Medium
CVE-2022-1682
Cross-site Scripting in facturascripts
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.