{"id":"CVE-2026-11959","kind":"vulnerability","aliases":["CVE-2026-11959"],"related":[],"title":"FacturaScripts: stored XSS in warehouse city and province fields","description":"Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).","summary":"FacturaScripts 2025.61 does not validate or sanitise the 'city' and 'province' fields on the ListAlmacen endpoint, so input stored there runs as JavaScript in other users' browsers. An attacker can use this to hijack sessions and, per the advisory, escalate from a normal user to administrator.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["facturascripts","package","php","self-hosted"],"not_affected_if":["single-user-instance"],"how_to_check":"- Check the installed FacturaScripts version in the application's about or package metadata; 2025.61 is affected per the sources\n- Confirm whether users other than administrators can edit warehouse (almacen) city and province fields\n- unknown","fix":"- Upgrade FacturaScripts beyond `2025.61`; the sources do not name a fixed version\n- unknown","status":"open","published_at":"2026-10-20T09:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:40:39+00:00","updated_at":"2026-10-25T03:40:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FacturaScripts beyond `2025.61`; the sources do not name a fixed version\n- unknown","reach":"internet","title":"FacturaScripts: stored XSS in warehouse city and province fields","impact":"high","summary":"FacturaScripts 2025.61 does not validate or sanitise the 'city' and 'province' fields on the ListAlmacen endpoint, so input stored there runs as JavaScript in other users' browsers. An attacker can use this to hijack sessions and, per the advisory, escalate from a normal user to administrator.","category":"package","nicknames":[],"who_cares":["facturascripts","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs JavaScript as victims, hijacks sessions, gains admin rights","analyst_note":"Confirm fixed version and check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-11959 and the FacturaScripts project advisories for the patch release.","how_to_check":"- Check the installed FacturaScripts version in the application's about or package metadata; 2025.61 is affected per the sources\n- Confirm whether users other than administrators can edit warehouse (almacen) city and province fields\n- unknown","needs_analyst":true,"not_affected_if":["single-user-instance"],"who_is_affected":"Teams running FacturaScripts 2025.61 where normal users can write warehouse records, since stored input from those fields is rendered in the browsers of other users, including administrators. Instances without multiple user roles or with those fields locked down are less exposed, but the sources do not say more. unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000649,"input_tokens":3445,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11959':12A,15A '-2026':11A,14A '2025.61':23B,77C 'adequ':83C 'administr':67B,132C 'advisori':60B 'allow':106C 'applic':120C 'arbitrari':111C 'attack':50B,108C 'browser':48B,118C 'caus':78C 'citi':6A,30B,92C 'code':113C,138C 'compromis':140C 'confidenti':144C 'cooki':152C 'could':105C 'craft':136C 'cross':70C 'cross-sit':69C 'csrf':155C 'cve':10A,13A 'endpoint':37B,99C 'escal':61B,124C 'even':149C 'execut':110C,134C 'exploit':101C 'extract':154C 'facturascript':1A,16B,22B,75C 'field':9A,33B,95C 'hijack':55B,146C 'host':21B 'httpon':151C 'input':39B,89C 'javascript':44B,112C,137C 'lack':81C 'listalmacen':36B,98C 'normal':64B,128C 'packag':17B 'per':58B 'php':18B 'privileg':125C 'provinc':8A,32B,94C 'run':42B 'sanitis':28B,86C 'script':72C 'self':20B 'self-host':19B 'session':56B,148C 'site':71C 'special':135C 'store':2A,40B,68C 'success':100C 'system':142C 'therebi':139C 'token':156C 'use':52B 'user':47B,65B,88C,121C,129C 'valid':26B,84C 'version':76C 'victim':116C 'vulner':104C 'warehous':5A 'xss':3A,73C","nicknames":[],"mitigations":[],"who_affected":"Teams running FacturaScripts 2025.61 where normal users can write warehouse records, since stored input from those fields is rendered in the browsers of other users, including administrators. Instances without multiple user roles or with those fields locked down are less exposed, but the sources do not say more. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11959","severity":null,"published_at":"2026-10-20T09:17:09+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}