CVE-2026-23476: Facturascripts

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

Affected products

Published 2026-02-02. Last modified 2026-06-17.