{"items":[{"id":"NVI-00003675","kind":"vulnerability","title":"FacturaScripts is Vulnerable to Reflected XSS","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g6w2-q45f-xrp4","CVE-2026-23476"],"plain_summary":"OSV carries this publisher advisory for facturascripts/facturascripts. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2025.81 for facturascripts/facturascripts. Confirm the publisher’s latest guidance.","source_ids":["sr-46eddb2e002034df2cfcf0994cb4a83a"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b82dda48e95b24b4a3026e4720398841"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.290%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.21624. Missing scores are unknown.","source_id":"sr-b82dda48e95b24b4a3026e4720398841"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-46eddb2e002034df2cfcf0994cb4a83a","url":"https://github.com/advisories/GHSA-g6w2-q45f-xrp4","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-g6w2-q45f-xrp4","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.412Z"},{"id":"sr-b82dda48e95b24b4a3026e4720398841","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-23476","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.375Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-46eddb2e002034df2cfcf0994cb4a83a"],"technology":"facturascripts/facturascripts","known_exclusions":[],"conditions_summary":"# Reflected XSS via SQL Error Messages\n\n## Summary\n\nA reflected XSS bug has been found in FacturaScripts. The problem is in how error messages get displayed - it's using Twig's `| raw` filter which skips HTML escaping. When a database error is triggered (like passing a string where an integer is expected), the error message includes all input and gets rendered without sanitization.\n\nAttackers can use this to phish credentials from other users since HttpOnly is set on cookies (so stealing cookies directly won't work, but attackers can inject a fake login form).\n\n**CVSS 6.1 (Medium-High)**\n\n---\n\n## What was Found\n\n### Where the bug exists in the code:\n\n`Core/View/Macro/Utils.html.twig`, line 27:\n\n```twig\n{% for item in messages %}\n    {{ item.message | raw }}\n{% endfor %}\n```\n\nThat `| raw` is the problem. It tells Twig not to escape anything.\n\n### How it works\n\nSo here's what happens:\n\n1. Hhit `/EditProducto?code= or `\n2. The app tries to look up a product with that \"code\"\n3. PostgreSQL throws an error because `` isn't a valid integer\n4. The error goes something like:   ```\n   ERROR: invalid input syntax","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2025.81"]}],"null_published_at":"2026-11-05T03:52:54.828Z","source_updated_at":"2026-02-03T17:52:46.306Z","source_disclosed_at":"2026-02-02T18:00:43.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:20.412Z"},{"id":"NVI-00003675","kind":"vulnerability","title":"FacturaScripts is Vulnerable to Reflected XSS","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g6w2-q45f-xrp4","CVE-2026-23476"],"plain_summary":"OSV carries this publisher advisory for facturascripts/facturascripts. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2025.81 for facturascripts/facturascripts. Confirm the publisher’s latest guidance.","source_ids":["sr-46eddb2e002034df2cfcf0994cb4a83a"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-46eddb2e002034df2cfcf0994cb4a83a","url":"https://github.com/advisories/GHSA-g6w2-q45f-xrp4","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-g6w2-q45f-xrp4","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.412Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-46eddb2e002034df2cfcf0994cb4a83a"],"technology":"facturascripts/facturascripts","known_exclusions":[],"conditions_summary":"# Reflected XSS via SQL Error Messages\n\n## Summary\n\nA reflected XSS bug has been found in FacturaScripts. The problem is in how error messages get displayed - it's using Twig's `| raw` filter which skips HTML escaping. When a database error is triggered (like passing a string where an integer is expected), the error message includes all input and gets rendered without sanitization.\n\nAttackers can use this to phish credentials from other users since HttpOnly is set on cookies (so stealing cookies directly won't work, but attackers can inject a fake login form).\n\n**CVSS 6.1 (Medium-High)**\n\n---\n\n## What was Found\n\n### Where the bug exists in the code:\n\n`Core/View/Macro/Utils.html.twig`, line 27:\n\n```twig\n{% for item in messages %}\n    {{ item.message | raw }}\n{% endfor %}\n```\n\nThat `| raw` is the problem. It tells Twig not to escape anything.\n\n### How it works\n\nSo here's what happens:\n\n1. Hhit `/EditProducto?code= or `\n2. The app tries to look up a product with that \"code\"\n3. PostgreSQL throws an error because `` isn't a valid integer\n4. The error goes something like:   ```\n   ERROR: invalid input syntax","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2025.81"]}],"null_published_at":"2026-10-31T22:12:48.026Z","source_updated_at":"2026-02-03T17:52:46.306Z","source_disclosed_at":"2026-02-02T18:00:43.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:20.412Z"}],"next_cursor":null,"snapshot_revision":"42594"}