User Enumeration Vulnerability in FacturaScripts by FacturaScripts

CVE-2026-11960

What is CVE-2026-11960?

In FacturaScripts version 2025.61, an unauthenticated user enumeration vulnerability enables attackers to differentiate between valid and invalid usernames based on the application's varying responses to login attempts. By exploiting response times, error message discrepancies, and different HTTP status codes, an attacker can effectively compile a list of valid user accounts. This information can facilitate further attacks such as brute-force, password spraying, or social engineering tactics aimed at the identified users.

References