Stored XSS in FacturaScripts 2025.61 ListAlmacen city/province fields
CVE-2026-11959 Published on October 20, 2026
Multiple vulnerabilities in FacturaScripts
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the city and province fields in the ListAlmacen endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victims browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the systems confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).
Vulnerability Analysis
CVE-2026-11959 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-11959 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-11959
Want to know whenever a new CVE is published for Facturascripts? stack.watch will email you.
