CVE-2026-11959 Multiple vulnerabilities in FacturaScripts
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-11959?
CVE-2026-11959 is a medium-severity vulnerability in FacturaScripts, published on 20 Oct 2026.
Official description
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).
Weakness: CWE-79
Which versions are affected by CVE-2026-11959?
How do I fix CVE-2026-11959?
No fix has been published for CVE-2026-11959 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11959 being exploited?
There is no known exploitation of CVE-2026-11959 in the wild and no public exploit code.
Sources
Also known as GHSA-hm23-2mjw-57qx.