5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23476

CVE-2026-23476: FacturaScripts Affected by Reflected XSS

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23476

CVE-2026-23476:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
facturascripts/facturascripts	composer	< 2025.81	2025.81

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in FacturaScripts. The root cause lies in the Core/View/Macro/Utils.html.twig template, specifically within the master macro. This macro uses Twig's |raw filter when rendering log messages, which disables the default output escaping and allows any HTML or JavaScript within the message to be executed by the browser.

The exploit chain begins when a user sends a request with a malicious payload to an endpoint that performs a database query, such as the EditProducto controller with a malformed code parameter. This input causes the database to throw an error. The DataBase::select method (or similar methods like exec and query) catches this error and logs the database's error message, which includes the original malicious payload.

Finally, this log message is passed to the Utils.master macro to be displayed to the user. Due to the |raw filter, the malicious script is rendered unescaped and executes in the context of the user's session. The fix involved removing the |raw filter from the template, ensuring all log messages are properly HTML-escaped by default.

Vulnerable functions

Utils.master

Core/View/Macro/Utils.html.twig

This Twig macro is responsible for rendering log messages. It uses the `|raw` filter, which disables Twig's default HTML escaping. When a database error message containing user-supplied malicious code is passed to this macro for display, the code is executed in the victim's browser. The patch fixes the vulnerability by removing the `|raw` filter, thus re-enabling output escaping.

DataBase::select

Core/Base/DataBase.php

This method executes SQL queries. When a query fails due to malformed user input (e.g., a string payload in a field expecting an integer), this method logs the resulting database error message. The database error message includes the user's malicious payload. This logged message is then rendered by the vulnerable `Utils.master` macro, leading to XSS. Other methods like `exec` and `query` in the same class also contain this logging behavior.

EditProducto::privateCore

Core/Controller/EditProducto.php

This controller acts as an entry point for the XSS attack. It processes the `code` URL parameter, which is then used in a database query. When a malicious string is provided in the `code` parameter, it causes a database error. The error message, now containing the attacker's payload, is logged and subsequently rendered by the vulnerable `Utils.master` macro. The description notes that numerous 'Edit' controllers (e.g., `EditCliente`, `EditFacturaCliente`) are similarly affected.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.