CVE-2026-11960 Multiple vulnerabilities in FacturaScripts
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-11960?
CVE-2026-11960 is a medium-severity vulnerability in FacturaScripts, published on 20 Oct 2026.
Official description
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application’s responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes. A successful exploit allows the attacker to compile a list of valid user accounts. This list could be used to carry out targeted brute-force attacks, password spraying, credential stuffing or social engineering campaigns against the confirmed accounts.
Weakness: CWE-79
Which versions are affected by CVE-2026-11960?
How do I fix CVE-2026-11960?
No fix has been published for CVE-2026-11960 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11960 being exploited?
There is no known exploitation of CVE-2026-11960 in the wild and no public exploit code.
Sources
Also known as GHSA-jfpr-pfqx-2q8x.