GHSA-GQ5C-RW37-G46C

Vulnerability from github – Published: 2026-05-07 19:34 – Updated: 2026-05-19 16:09
VLAI
Summary
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
Details

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization.

Details

The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect.

PoC

  1. Log in to the application with any valid account. image

  2. Capture any the GET request . image

  3. Modify the value of "fsNick" with the following JavaScript: <script>alert(window.origin)</script>

  4. Send the modified request. image

  5. Result image

Impact

The payload executes before the session ends, which could potentially allow for a single unauthorized action before the logout.

Severity
3.9 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "facturascripts/facturascripts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2025.71"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27964"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T19:34:28Z",
    "nvd_published_at": "2026-05-18T22:16:38Z",
    "severity": "LOW"
  },
  "details": "### Summary\nA Reflected Cross-Site Scripting (XSS) vulnerability exists in the fsNick cookie parameter. The application reflects the cookie\u0027s value directly into the HTML without sanitization.\n\n### Details\nThe fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect.\n\n### PoC\n\n1. Log in to the application with any valid account.\n\u003cimg width=\"2078\" height=\"302\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d8a9a779-44e0-4a3e-839f-0a031868fbd5\" /\u003e\n\n2. Capture any the GET request .\n\u003cimg width=\"1267\" height=\"276\" alt=\"image\" src=\"https://github.com/user-attachments/assets/22e43f73-4f86-4cab-a074-7aba584a71ac\" /\u003e\n\n3. Modify  the value of \"fsNick\" with the following JavaScript:\n`\u003cscript\u003ealert(window.origin)\u003c/script\u003e`\n\n4. Send the modified request.\n\u003cimg width=\"1569\" height=\"319\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ade88db1-aadc-4c50-9e02-d09888067e98\" /\u003e\n\n5. Result\n\u003cimg width=\"1217\" height=\"771\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5858fe9f-127a-4845-b484-5a7ef4ae2cb4\" /\u003e\n\n### Impact\nThe payload executes before the session ends, which could potentially allow for a single unauthorized action before the logout.",
  "id": "GHSA-gq5c-rw37-g46c",
  "modified": "2026-05-19T16:09:41Z",
  "published": "2026-05-07T19:34:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-gq5c-rw37-g46c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27964"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NeoRazorX/facturascripts/commit/9066e10326029adf012114e27eb5f3f33f78ecfd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NeoRazorX/facturascripts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.