Threats tagged 'ghsa-3x7p-v8hj-xh5m'

FacturaScripts versions prior to 2026.2 contain a stored cross-site scripting (XSS) vulnerability in the WidgetVariante and WidgetSubcuenta modal lists. The vulnerability arises because user-controlled fields are inserted directly into JavaScript string literals inside HTML onclick attributes with only HTML entity escaping, which browsers decode before JavaScript parsing, allowing injection of arbitrary JavaScript code. This flaw was not addressed in these two widget classes during a recent fix wave that corrected similar issues in related classes. The vulnerability allows an attacker with write access to store payloads that execute when users open the affected modals.