Live › vulnerability › CVE-2026-11959
Go to dashboardFacturaScripts 2025.61 does not validate or sanitise the 'city' and 'province' fields on the ListAlmacen endpoint, so input stored there runs as JavaScript in other users' browsers. An attacker can use this to hijack sessions and, per the advisory, escalate from a normal user to administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running FacturaScripts 2025.61 where normal users can write warehouse records, since stored input from those fields is rendered in the browsers of other users, including administrators. Instances without multiple user roles or with those fields locked down are less exposed, but the sources do not say more. unknown
No product ranges from the sources yet.
2025.61; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).
This page as .md · .json · in your agent: get_signal("CVE-2026-11959")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.