Cross-site scripting in FacturaScripts - CVE-2026-27964
Published: November 9, 2026
Vulnerability identifier: #VU163107
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-27964
CWE-ID: CWE-79
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated attacker to execute JavaScript in the application's origin through reflected cross-site scripting in FacturaScripts.
The vulnerability exists due to missing HTML encoding when FacturaScripts reflects the fsNick cookie value into a page returned for a GET request. A local authenticated attacker can modify this cookie after logging in with any valid account and have the returned page loaded, causing script execution before the application forces a logout.
Affected software
FacturaScripts
How to mitigate CVE-2026-27964
Install security update from vendor's website.
FacturaScripts - update to 2025.8