CVE-2026-11960
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application's responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes.
Risk Assessment
An attacker can compile a list of valid user accounts and use it for brute-force attacks, password spraying, credential stuffing or social engineering campaigns.
Recommendation
Update FacturaScripts to a version with the fix that normalizes login responses and implement mechanisms to limit login attempts.
Other vulnerabilities in FacturaScripts
See all- CVE-2026-11959Medium
A Stored Cross-Site Scripting (XSS) vulnerability exists in FacturaScripts version 2025.61 due to insufficient validation or sanitisation of user input in the 'city' and 'province' fields in the 'ListAlmacen' endpoint. Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser or escalate privileges from a normal user to an administrator.
- CVE-2026-104905High
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
- CVE-2026-42879Medium
FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in the product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation; the file is stored with its original extension, including executable .php. The vulnerability exists in the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.
- CVE-2026-42878Medium
FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including database credentials, API keys, and application secrets), filesystem paths, and loaded extensions without authentication.
- CVE-2026-27964Low
FacturaScripts up to version 2025.7 has a Reflected XSS vulnerability via the fsNick cookie parameter. The cookie value is reflected in HTML without sanitization, allowing script execution before redirect. Fixed in version 2025.8.
- CVE-2026-27892Medium
FacturaScripts before version 2026 stores and serves uploaded images without stripping EXIF/XMP/IPTC metadata. Authenticated users can download an image and extract the uploader's personal data such as GPS coordinates, device information, and timestamps.
- CVE-2026-27891High
FacturaScripts versions 2026 and below contain a critical vulnerability in the Plugins::add() function that fails to properly validate file paths within uploaded ZIP archives. This allows a Zip Slip attack, leading to arbitrary file write and remote code execution (RCE) by overwriting sensitive .php files outside the plugins directory.
- CVE-2026-32699Medium
FacturaScripts up to version 2025.92 fails to validate the 'nick' parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, an attacker can intercept the request and modify the parameter to rename any account, including the administrator.
Original NVD description (English source)
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS