CVE-2025-69210 json
FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
published 2025-12-30 10 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-205844 , GHSA-2267-xqcf-gw2m
- cvss
- 5.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 1
- Exploit-DB
Summary
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.
Patch / fix
- packagist facturascripts/facturascripts 2025.7
- facturascripts facturascripts 2025.7
Timeline
- Published
- First public exploit (EDB-52517)
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-52517 FacturaScripts 2025.43 - XSS webapps, 2026-04-29
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 1.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U |
| CNA | 4.0 | 1.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | facturascripts/facturascripts | <2025.7 1 listed version |
2025.7 |
Affected products
- NeoRazorX facturascripts
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/NeoRazorX/facturascripts/commit/e908ade21c84bdc9d51190057482316730c66146
web
-
github.com
/NeoRazorX/facturascripts/security/advisories/GHSA-2267-xqcf-gw2m
web, vendor-advisory
-
facturascripts.com
/publicaciones/ya-disponible-facturascripts-2025-7
web, release-notes
-
github.com
/NeoRazorX/facturascripts/releases/tag/v2025.7
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2025-69210
advisory
-
github.com
/NeoRazorX/facturascripts
package
Sources
- CVE List CVE-2025-69210
- GitHub Advisory GHSA-2267-xqcf-gw2m
- NVD CVE-2025-69210
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.