Reflected XSS Vulnerability in FacturaScripts by NeoRazorX

CVE-2026-23476

What is CVE-2026-23476?

FacturaScripts, an open-source enterprise resource planning and accounting software, is vulnerable to a reflected Cross-Site Scripting (XSS) flaw due to improper handling of error messages. This vulnerability arises when the software displays error messages using Twig's | raw filter, which does not perform HTML escaping. Consequently, if a user triggers a database error—such as entering a string where an integer is expected—the error message incorporates the unsanitized input. This flaw was addressed in version 2025.8, providing users with a necessary patch to safeguard against potential exploitation.

References