FacturaScripts is Vulnerable to Reflected XSS
Date: 2026-02
Affected: composer/facturascripts/facturascripts
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-23476
CWE: CWE-79
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

# Reflected XSS via SQL Error Messages ## Summary A reflected XSS bug has been found in FacturaScripts. The problem is in how error messages get displayed - it's using Twig's `| raw` filter which skips HTML escaping. When a database error is triggered (like passing a string where an integer is expected), the error message includes all input and gets rendered without sanitization. Attackers can use this to phish credentials from other users since HttpOnly is set on cookies (so stealing cookies directly won't work, but attackers can inject a fake login form). **CVSS 6.1 (Medium-High)** --- ## What was Found ### Where the bug exists in the code: `Core/View/Macro/Utils.html.twig`, line 27: ```twig {% for item in messages %} <div>{{ item.message | raw }}</div> {% endfor %} ``` That `| raw` is the problem. It tells Twig not to escape anything. ### How it works So here's what happens: 1. Hhit `/EditProducto?code=<svg onload=alert(1)> or <img src=x onerror=alert(1)>` 2. The app tries to look up a product with that "code" 3. PostgreSQL throws an error because `<svg onload=alert(1)>` isn't a valid integer 4. The error goes something like: ``` ERROR: invalid input syntax for type integer: "<svg onload=alert(1)>" LINE 1: SELECT * FROM "productos" WHERE "idproducto" = '<img src=x onerror=alert(1)>" ``` 5. This gets logged via MiniLog and displayed to the user 6. Because of `| raw`, the browser actually executes the JS The error logging happens in `Core/Base/Da


Mitigations:

Architectural layers (MAESTRO):