Loading...
Skip to main content
GeekWala

CVE-2025-69210 — Vulnerability in facturascripts/facturascripts —...

HIGH

FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Published December 30, 2025Updated February 3, 2026Source: osv

Summary

A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.

Advisory Timeline

  • First published December 30, 2025 (286 days ago).
  • Last revised February 3, 2026 — 34 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update facturascripts/facturascripts to 2025.7 or later
composer require "facturascripts/facturascripts:^2025.7"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
facturascripts/facturascripts
packagist
2025.43No fix available
facturascripts/facturascripts
packagist
2018.03, 2018.04, 2018.05, 2018.11 (+46 more)2025.7
facturascripts/facturascripts
packagist
2025.11No fix available
facturascripts/facturascripts
packagist
2025.41No fix available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-79
    Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2025-69210?
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.1/10).
How do I check if my project is affected by CVE-2025-69210?
CVE-2025-69210 affects facturascripts/facturascripts. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-69210 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.1

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-2267-xqcf-gw2m

Related CVEs

  • CVE-2026-45262
    CRITICAL

    FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

  • CVE-2026-47677
    CRITICAL

    FacturaScripts: Account takeover of any 2FA-enabled user

  • CVE-2026-25514
    HIGH

    FacturaScripts has SQL Injection in Autocomplete Actions

  • CVE-2026-65954
    HIGH

    PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

  • CVE-2026-61825
    HIGH

    code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies