Live › vulnerability › CVE-2026-27964
FacturaScripts copies the fsNick cookie value into the HTML without encoding it, so a crafted cookie can run JavaScript in a logged-in user's browser. The server logs the user out after rejecting the modified session, but the injected script runs first, so an attacker may get one action before the logout.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:59 UTC, 0h before NVD. All times on this page are UTC.
Self-hosted FacturaScripts installations in the affected version ranges are exposed, because the fsNick cookie value is rendered into HTML without encoding. The attack needs a logged-in user to be tricked into sending a crafted request, so instances used only on a closed internal network are lower risk. Teams on the fixed versions or on a hosted service that already runs them can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| facturascripts/facturascripts | composer | < 2025.8 | 2025.8 |
| facturascripts/facturascripts | composer | >= 2025.11, < 2025.81 | 2025.81 |
facturascripts/facturascripts in composer.lock or with composer show facturascripts/facturascriptsfacturascripts/facturascripts below 2025.8: move to 2025.8facturascripts/facturascripts from 2025.11 below 2025.81: move to 2025.81Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization.
The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect.
Log in to the application with any valid account.
<img width="2078" height="302" alt="image" src="https://github.com/user-attachments/assets/d8a9a779-44e0-4a3e-839f-0a031868fbd5" />Capture any the GET request .
<img width="1267" height="276" alt="image" src="https://github.com/user-attachments/assets/22e43f73-4f86-4cab-a074-7aba584a71ac" />Modify the value of "fsNick" with the following JavaScript:
<script>alert(window.origin)</script>
Send the modified request.
<img width="1569" height="319" alt="image" src="https://github.com/user-attachments/assets/ade88db1-aadc-4c50-9e02-d09888067e98" />Result
<img width="1217" height="771" alt="image" src="https://github.com/user-attachments/assets/5858fe9f-127a-4845-b484-5a7ef4ae2cb4" />The payload executes before the session ends, which could potentially allow for a single unauthorized action before the logout.
This page as .md · .json · in your agent: get_signal("CVE-2026-27964")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.