8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23997

CVE-2026-23997: FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View

FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23997

CVE-2026-23997:

8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
facturascripts/facturascripts	composer	<= 2025.71

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) that stems from two combined weaknesses: logging unsanitized user input and rendering those logs without proper output escaping.

The investigation of the security patches identified two key commits that address this vulnerability. The first commit, 9066e10326029adf012114e27eb5f3f33f78ecfd, patches several functions (auth, changePasswordAction, send) that were logging raw user-provided data. It does so by wrapping the user input with htmlspecialchars before it is written to the log. This prevents malicious HTML from being stored in the first place.

The second and most critical commit, 2afd98cecd26c5f8357e0e321d86063ad1012fc3, fixes the root cause of the XSS rendering. It removes the |raw filter within the Core/View/Macro/Utils.html.twig template. This Twig filter explicitly disables output escaping, which allowed the stored malicious scripts to be executed in the browser of anyone viewing the logs (e.g., the "History" tab).

The vulnerability described in the report, involving the "Observations" field, is an instance of this general pattern. A controller responsible for saving delivery notes was logging the content of the "Observations" field without sanitization. When the history for that note was viewed, the vulnerable Twig macro would render the log entry, executing the attacker's script. The functions identified above are also part of this vulnerable pattern, as they processed potentially malicious input that was rendered in the same insecure way.

Vulnerable functions

FacturaScripts\Core\Base\Controller::auth

Core/Base/Controller.php

This function logs the user's nickname from a cookie without sanitization. The application was vulnerable to XSS because these logs were rendered without proper HTML escaping in the history/log view. An attacker could manipulate the cookie to inject a malicious script, which would execute in an administrator's browser when viewing the logs.

FacturaScripts\Core\Controller\Login::changePasswordAction

Core/Controller/Login.php

This function logs the username when a password change fails due to mismatched passwords. The username, which is user-controlled, was logged without sanitization. This created a stored XSS vulnerability, as the unsanitized username would be rendered in the log view, allowing script execution.

FacturaScripts\Core\Controller\SendMail::send

Core/Controller/SendMail.php

This function logs invalid email addresses provided by the user in the 'From', 'To', 'CC', or 'BCC' fields. These email addresses were logged without being sanitized. When an administrator viewed the logs containing these invalid email entries, any injected script would be executed due to insecure rendering in the log view.

FacturaScripts\Core\Template\Controller::auth

Core/Template/Controller.php

Similar to the auth function in `Core/Base/Controller.php`, this function logs the user's nickname from a cookie without sanitization. This input was then rendered unescaped in the log viewer, leading to a stored XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.