{"items":[{"id":"NVI-00005178","kind":"vulnerability","title":"FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-2267-xqcf-gw2m","CVE-2025-69210"],"plain_summary":"OSV carries this publisher advisory for facturascripts/facturascripts, facturascripts/facturascripts, facturascripts/facturascripts, facturascripts/facturascripts. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2025.7 for facturascripts/facturascripts. Confirm the publisher’s latest guidance.","source_ids":["sr-85c2af5783461b2ef40883cca7085ba9"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5f2266c61201cce5bb71da0a314ac83a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.972%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.61985. Missing scores are unknown.","source_id":"sr-5f2266c61201cce5bb71da0a314ac83a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-85c2af5783461b2ef40883cca7085ba9","url":"https://github.com/advisories/GHSA-2267-xqcf-gw2m","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-2267-xqcf-gw2m","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:40.007Z"},{"id":"sr-5f2266c61201cce5bb71da0a314ac83a","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2025-69210","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.373Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-85c2af5783461b2ef40883cca7085ba9"],"technology":"facturascripts/facturascripts","known_exclusions":[],"conditions_summary":"A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.\n\nAuthenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.\n\nBecause product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2025.7"]},{"certainty":"source_listed","source_ids":["sr-85c2af5783461b2ef40883cca7085ba9"],"technology":"facturascripts/facturascripts","known_exclusions":[],"conditions_summary":"A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.\n\nAuthenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.\n\nBecause product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.","public_affected_ranges":[]}],"null_published_at":"2026-11-01T01:45:38.530Z","source_updated_at":"2026-02-03T03:14:11.581Z","source_disclosed_at":"2025-12-30T20:52:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:40.007Z"},{"id":"NVI-00005178","kind":"vulnerability","title":"FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-2267-xqcf-gw2m","CVE-2025-69210"],"plain_summary":"OSV carries this publisher advisory for facturascripts/facturascripts, facturascripts/facturascripts, facturascripts/facturascripts, facturascripts/facturascripts. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2025.7 for facturascripts/facturascripts. Confirm the publisher’s latest guidance.","source_ids":["sr-85c2af5783461b2ef40883cca7085ba9"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-85c2af5783461b2ef40883cca7085ba9","url":"https://github.com/advisories/GHSA-2267-xqcf-gw2m","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-2267-xqcf-gw2m","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:40.007Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-85c2af5783461b2ef40883cca7085ba9"],"technology":"facturascripts/facturascripts","known_exclusions":[],"conditions_summary":"A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.\n\nAuthenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.\n\nBecause product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2025.7"]},{"certainty":"source_listed","source_ids":["sr-85c2af5783461b2ef40883cca7085ba9"],"technology":"facturascripts/facturascripts","known_exclusions":[],"conditions_summary":"A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.\n\nAuthenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.\n\nBecause product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.","public_affected_ranges":[]}],"null_published_at":"2026-10-31T22:13:01.453Z","source_updated_at":"2026-02-03T03:14:11.581Z","source_disclosed_at":"2025-12-30T20:52:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:40.007Z"}],"next_cursor":null,"snapshot_revision":"42594"}