CVE-2022-1514 Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts
Attackers can inject malicious scripts via zip plugin uploads, leading to data exfiltration or account takeover in FacturaScripts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1514?
CVE-2022-1514 is a critical cross-site scripting vulnerability in neorazorx/facturascripts, published on 28 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Weakness: CWE-79
Which versions are affected by CVE-2022-1514?
2 open source packages ship an affected version, including facturascripts/facturascripts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
facturascripts/facturascripts Packagist | All versions | 2022.06 |
facturascripts/facturascripts Packagist | All versions | 2022.06 |
Products include Facturascripts Facturascripts.
How do I fix CVE-2022-1514?
Upgrade facturascripts/facturascripts to 2022.06 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-1514 being exploited?
There is no known exploitation of CVE-2022-1514 in the wild and no public exploit code.
Other vulnerabilities in neorazorx/facturascripts
- CVE-2022-1571 Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts
- CVE-2022-1715 Account Takeover in neorazorx/facturascripts
- CVE-2022-1682 Reflected Xss using url based payload in neorazorx/facturascripts
- CVE-2022-1457 Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts
- CVE-2026-25514 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions
Sources
Also known as GHSA-p3w3-4ppm-c3f6.