CVE-2026-27964

Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application's responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes.

A Stored Cross-Site Scripting (XSS) vulnerability exists in FacturaScripts version 2025.61 due to insufficient validation or sanitisation of user input in the 'city' and 'province' fields in the 'ListAlmacen' endpoint. Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser or escalate privileges from a normal user to an administrator.

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.

FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in the product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation; the file is stored with its original extension, including executable .php. The vulnerability exists in the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.

FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including database credentials, API keys, and application secrets), filesystem paths, and loaded extensions without authentication.

FacturaScripts before version 2026 stores and serves uploaded images without stripping EXIF/XMP/IPTC metadata. Authenticated users can download an image and extract the uploader's personal data such as GPS coordinates, device information, and timestamps.

FacturaScripts versions 2026 and below contain a critical vulnerability in the Plugins::add() function that fails to properly validate file paths within uploaded ZIP archives. This allows a Zip Slip attack, leading to arbitrary file write and remote code execution (RCE) by overwriting sensitive .php files outside the plugins directory.

FacturaScripts up to version 2025.92 fails to validate the 'nick' parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, an attacker can intercept the request and modify the parameter to rename any account, including the administrator.