CVE-2026-42877

FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.

• CWE-79

• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42871WeGIA is a web manager for charitable institutions. In versi…6.9
• CVE-2026-42872WeGIA is a web manager for charitable institutions. In versi…6.1
• CVE-2026-42873WeGIA is a web manager for charitable institutions. In versi…0
• CVE-2026-42874Microdot is a minimalistic Python web framework. Prior to 2.…3.7
• CVE-2026-42875External Secrets Operator reads information from a third-par…5.3
• CVE-2026-42876External Secrets Operator reads information from a third-par…4.9
• CVE-2026-42878FacturaScripts is an open source accounting and invoicing so…5.3
• CVE-2026-42879FacturaScripts is an open source accounting and invoicing so…6.3
• CVE-2026-4288A weakness has been identified in Tiandy Easy7 Integrated Ma…7.3
• CVE-2026-42880Argo CD is a declarative, GitOps continuous delivery tool fo…9.6
• CVE-2026-42881STIGQter is an open-source reimplementation of DISA's STIG V…8.4
• CVE-2026-42882oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior …9.4