CVE-2026-23476 is a reflected Cross-Site Scripting (XSS) vulnerability in FacturaScripts, an open-source ERP and accounting software, affecting versions prior to 2025.8. The flaw arises from improper sanitization of error messages, where user-supplied input is rendered directly via Twig's |raw filter, allowing for injection of malicious scripts. Rated MEDIUM with a CVSS score of 5.4, this vulnerability requires user interaction (UI:R) and low privileges (PR:L) to exploit, potentially leading to client-side information disclosure (C:L) and integrity compromise (I:L). The attack complexity is low (AC:L) and the attack vector is network-based (AV:N). Currently, there is no evidence of active exploitation, nor is public exploit code available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2025.8CPE matchmatch criteria | cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.