CVE-2026-23997

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-239987.5Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could a CVE-2026-239995.5Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable CVE-2026-24004.3CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to re CVE-2026-240005.3Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-supplied IP address headers when determining CVE-2026-240017.5jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose CVE-2026-240029.6Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, fo CVE-2026-240035.3EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verificatio CVE-2026-240045.3Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub/Sub handling could CVE-2026-240057.6Kruise provides automated management of large-scale applications on Kubernetes. Prior to versions 1.8.3 and 1.7.5, PodProbeMarker allows def CVE-2026-240067.5Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, CVE-2026-240074.6Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview i CVE-2026-240099.8Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling.