Cross-site scripting in FacturaScripts - CVE-2026-77529
Published: November 9, 2026
Vulnerability identifier: #VU163136
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-77529
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an administrator to execute stored JavaScript in another administrator's session when the victim views sent email in FacturaScripts.
The vulnerability exists due to incomplete client-side HTML sanitization in the EmailSentHtml viewer when rendering stored email bodies. An administrator can plant malicious HTML through notification templates or SendMail access, causing script execution with access to the victim's session data and CSRF tokens when the victim opens the email HTML tab.
Affected software
FacturaScripts
How to mitigate CVE-2026-77529
Install security update from vendor's website.
FacturaScripts - update to 2026.2