PatchSiren cyber security CVE debrief
CVE-2026-42877 NeoRazorX CVE debrief
A stored cross-site scripting (XSS) vulnerability in FacturaScripts 2025.92 and earlier allows authenticated users with warehouse module access to inject malicious JavaScript via product references. The payload executes when other users open the product search modal within sales or purchase documents. The vulnerability resides in two PHP files handling AJAX modal rendering for sales and purchasing workflows.
- Vendor
- NeoRazorX
- Product
- facturascripts
- CVSS
- MEDIUM 5.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-29
Who should care
Organizations using FacturaScripts for accounting and invoicing, particularly those with multi-user environments where warehouse staff and accounting personnel have segregated access. Security teams monitoring for supply chain risks in open-source business applications.
Technical summary
The vulnerability exists in the product search modal functionality used when creating invoices, orders, and delivery notes. An attacker with warehouse module privileges can create a product containing a malicious reference string. When another user opens the product search modal in a sales or purchase document context, the unsanitized reference renders as executable JavaScript in the victim's browser. The affected components are Core/Lib/AjaxForms/SalesModalHTML.php for sales documents and Core/Lib/AjaxForms/PurchasesModalHTML.php for purchase documents. The CVSS 3.1 score of 5.4 reflects network attack vector, low attack complexity, required low privileges, required user interaction, changed scope, and low impacts to confidentiality and integrity with no availability impact.
Defensive priority
medium
Recommended defensive actions
- Upgrade FacturaScripts to a version later than 2025.92 when available
- Review product reference input validation in Core/Lib/AjaxForms/SalesModalHTML.php and Core/Lib/AjaxForms/PurchasesModalHTML.php
- Implement Content Security Policy headers to mitigate XSS impact
- Audit existing product references for suspicious JavaScript patterns
- Restrict warehouse module access to trusted administrative users pending patch
Evidence notes
NVD record published 2026-05-27 with CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. GitHub Security Advisory GHSA-r736-2678-fcrx cited as primary source. CPE criteria not yet populated in NVD feed.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-42877 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-42877
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-42877 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42877
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-r736-2678-fcrx
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.