Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-hgjx-r89m-m7v4
  • Packagist/facturascripts/facturascripts
 FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE 14 Jul
  • No fix available
  • Severity - 9.9 (Critical)
GHSA-3x7p-v8hj-xh5m
  • Packagist/facturascripts/facturascripts
 FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=` 14 Jul
  • No fix available
  • Severity - 3.5 (Low)
GHSA-2p5x-4jr6-x5jg
  • Packagist/facturascripts/facturascripts
 FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export 14 Jul
  • No fix available
  • Severity - 8.0 (High)
GHSA-cv65-7cg8-r623
  • Packagist/facturascripts/facturascripts
 FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents 14 Jul
  • No fix available
  • Severity - 7.5 (High)
GHSA-5qmh-x653-g8qj
  • Packagist/facturascripts/facturascripts
 FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` 14 Jul
  • No fix available
  • Severity - 9.9 (Critical)
GHSA-c67f-gmxw-mj93
  • Packagist/facturascripts/facturascripts
 FacturaScripts: Account takeover of any 2FA-enabled user 13 Jul
  • Fix available
  • Severity - 9.3 (Critical)
CVE-2026-42879
  • github.com/neorazorx/facturascripts
 FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images 27 May
  • No fix available
  • Severity - 6.3 (Medium)
CVE-2026-42878
  • github.com/neorazorx/facturascripts
 FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts 27 May
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-27964
  • github.com/neorazorx/facturascripts
 FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation 18 May
  • Fix available
  • Severity - 3.9 (Low)
CVE-2026-27892
  • github.com/neorazorx/facturascripts
 FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download 18 May
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2026-27891
  • github.com/neorazorx/facturascripts
 Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism 18 May
  • Fix available
  • Severity - 7.2 (High)
GHSA-vf3q-frmr-vrr9
  • Packagist/facturascripts/facturascripts
 FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images 07 May
  • No fix available
  • Severity - 6.3 (Medium)
GHSA-vrxf-vrc4-22p7
  • Packagist/facturascripts/facturascripts
 FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint 07 May
  • No fix available
  • Severity - 5.3 (Medium)
GHSA-r736-2678-fcrx
  • Packagist/facturascripts/facturascripts
 FacturaScripts vulnerable to stored XSS via product reference in sales/purchases 07 May
  • No fix available
  • Severity - 5.4 (Medium)
GHSA-gq5c-rw37-g46c
  • Packagist/facturascripts/facturascripts
 FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation 07 May
  • No fix available
  • Severity - 3.9 (Low)
GHSA-q7f2-rv22-2xgr
  • Packagist/facturascripts/facturascripts
 FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download 07 May
  • No fix available
  • Severity - 6.5 (Medium)
Load more...