CVE-2026-11959: FacturaScripts 2025.61

Affected technology

FacturaScripts · 2025.61
FacturaScripts

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

An attacker could execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens). Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as high; integrity and availability impact as none.