CVE-2026-42877

{
  "id": "CVE-2026-42877",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T20:16:36.673",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note."
    },
    {
      "lang": "es",
      "value": "FacturaScripts es un software de contabilidad y facturación de código abierto. En la versión 2025.92 y anteriores, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en el modal de búsqueda de productos de documentos de ventas (Core/Lib/AjaxForms/SalesModalHTML.php) y compras (Core/Lib/AjaxForms/PurchasesModalHTML.php). Un usuario autenticado con acceso al módulo de almacén puede crear un producto con una referencia maliciosa que ejecuta JavaScript arbitrario en el navegador de cualquier otro usuario que abra el modal de búsqueda de productos dentro de una factura, pedido o albarán."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NeoRazorX",
          "product": "facturascripts",
          "versions": [
            {
              "version": "<= 2025.92",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T15:13:50.730745Z",
          "id": "CVE-2026-42877",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}