Cross-site Scripting in FacturaScripts

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2022-2065 · ADVISORY
• neorazorx/facturascripts commit 1d1edb4 · WEB
• neorazorx/facturascripts · PACKAGE
• huntr.dev/bounties/bcb44da4-d5c9-4830-924f-02d6defe6506 · WEB

Lỗ hổng khác của facturascripts/facturascripts

• GHSA-hgjx-r89m-m7v4NGHIÊM TRỌNG 9.9FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE
• CVE-2026-45710THẤP 3.5FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes i…
• CVE-2026-45263CAO 8.0FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens th…
• CVE-2026-45693CAO 7.5FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents
• CVE-2026-45262NGHIÊM TRỌNG 9.9FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`