CVE-2022-1457 Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts
Stored XSS in FacturaScripts allows attackers to inject scripts via the title parameter, potentially stealing sessions or data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1457?
CVE-2022-1457 is a critical cross-site scripting vulnerability in neorazorx/facturascripts, published on 25 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Weakness: CWE-79
Which versions are affected by CVE-2022-1457?
2 open source packages ship an affected version, including neorazorx/facturascripts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
neorazorx/facturascripts Packagist | All versions | 2022.04 |
neorazorx/facturascripts Packagist | All versions | 2022.04 |
Products include Facturascripts Facturascripts.
How do I fix CVE-2022-1457?
Upgrade neorazorx/facturascripts to 2022.04 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-1457 being exploited?
There is no known exploitation of CVE-2022-1457 in the wild and no public exploit code.
Other vulnerabilities in neorazorx/facturascripts
- CVE-2022-1571 Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts
- CVE-2022-1715 Account Takeover in neorazorx/facturascripts
- CVE-2022-1682 Reflected Xss using url based payload in neorazorx/facturascripts
- CVE-2022-1514 Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts
- CVE-2026-25514 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions
Sources
Also known as GHSA-8wp2-vxpg-xcvp.