---
id: CVE-2026-11959
title: Multiple vulnerabilities in FacturaScripts
summary: >-
  Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused
  by a lack of adequate validation or sanitisation of user input in the ‘city’
  and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation
  of thi…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: FacturaScripts
product: FacturaScripts
affected:
  - FacturaScripts 2025.61
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T15:54:03.683667Z'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T15:54:13.922Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-11959'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-facturascripts
tags:
  - cve.org
epss: 0.0023
epssPercentile: 0.12983
ingestedAt: '2026-10-20T12:05:07.359Z'
---

## Overview

Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser (the application user) or to escalate privileges from a normal user to an administrator by executing specially crafted JavaScript code, thereby compromising the system’s confidentiality or hijacking the session (even with httpOnly cookies by extracting CSRF tokens).

## Affected

- `FacturaScripts 2025.61`

## Remediation

Update to commit llowing commits: https://github.com/NeoRazorX/facturascripts/commit/aa728f642b467bb73bf183067912bd97536d06a6