Unauthenticated Username Enumeration Vulnerability in FacturaScripts 2025.61
CVE-2026-11960 Published on October 20, 2026
Multiple vulnerabilities in FacturaScripts
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the applications responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts.
Vulnerability Analysis
CVE-2026-11960 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-11960 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-11960
Want to know whenever a new CVE is published for Facturascripts? stack.watch will email you.
