EUVD-2026-322475

fkie_cve-2026-42877

FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales (Core/Lib/AjaxForms/SalesModalHTML.php) and purchases documents (Core/Lib/AjaxForms/PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.

GHSA-r736-2678-fcrx — FacturaScripts vulnerable to stored XSS via product reference in sales/purchases

Affected: Packagist: facturascripts/facturascripts

## Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales and purchases documents. An authenticated user with access to the warehouse module can create a product with a malicious reference that executes arbitrary JavaScript in the browser of any other user who opens the product search modal inside an invoice, order, or delivery note.

## Affected files

- `Core/Lib/AjaxForms/SalesModalHTML.php` - `Core/Lib/AjaxForms/PurchasesModalHTML.php`

## Vulnerability details

The `referencia` field of a product variant is injected directly into an HTML `onclick` attribute string without JavaScript context escaping:

```php // SalesModalHTML.php ~line 102 $tbody .= '<tr onclick="return salesFormAction(\'add-product\', \'' . $row['referencia'] // no htmlspecialchars() applied . '\');">'; ```

When a product is saved, `noHtml()` encodes `'` → `'`. This appears safe in static HTML context. However, the modal HTML is later returned as a JSON response and inserted into the DOM via `innerHTML`:

```javascript // SalesDocument.html.twig line 118 document.getElementById("findProductList").innerHTML = data.products; ```

The browser HTML parser decodes `'` → `'` during the `innerHTML` assignment, breaking out of the JavaScript string literal in the `onclick` attribute and executing the injected code.

**Attack payload stored in database:** `x'+alert(1)+'`

**Resulting `onclick` after `innerHTML` decode:** ```javascript re…

Most recent entries from all

EUVD-2026-322475

fkie_cve-2026-42877

GHSA-r736-2678-fcrx — FacturaScripts vulnerable to stored XSS via product reference in sales/purchases