Stored XSS Vulnerability in FacturaScripts Affects User Input Fields

CVE-2026-11959

What is CVE-2026-11959?

A stored Cross-Site Scripting (XSS) vulnerability exists in FacturaScripts, specifically in version 2025.61. This flaw arises from insufficient validation of user inputs in the ‘city’ and ‘province’ fields of the ‘ListAlmacen’ endpoint. An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the browser of an authenticated user, possibly enabling them to escalate their privileges to that of an administrator. This poses significant risks such as compromising user session data, including CSRF tokens, and undermining the confidentiality of the application.

References