{"id":"CVE-2026-27964","aliases":["GHSA-gq5c-rw37-g46c"],"url":"https://o3.security/vulnerability/CVE-2026-27964","summary":"FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation","details":"### Summary\nA Reflected Cross-Site Scripting (XSS) vulnerability exists in the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization.\n\n### Details\nThe fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect.\n\n### PoC\n\n1. Log in to the application with any valid account.\n<img width=\"2078\" height=\"302\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d8a9a779-44e0-4a3e-839f-0a031868fbd5\" />\n\n2. Capture any the GET request .\n<img width=\"1267\" height=\"276\" alt=\"image\" src=\"https://github.com/user-attachments/assets/22e43f73-4f86-4cab-a074-7aba584a71ac\" />\n\n3. Modify  the value of \"fsNick\" with the following JavaScript:\n`<script>alert(window.origin)</script>`\n\n4. Send the modified request.\n<img width=\"1569\" height=\"319\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ade88db1-aadc-4c50-9e02-d09888067e98\" />\n\n5. Result\n<img width=\"1217\" height=\"771\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5858fe9f-127a-4845-b484-5a7ef4ae2cb4\" />\n\n### Impact\nThe payload executes before the session ends, which could potentially allow for a single unauthorized action before the logout.","published":"2026-05-18T22:05:02.529Z","modified":"2026-10-28T02:30:58.296066678Z","cvss":{"score":3.9,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},"epss":{"score":0.00104,"percentile":0.01191,"asOf":"2026-08-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"facturascripts/facturascripts","fixedVersion":"2025.8"},{"ecosystem":"Packagist","name":"facturascripts/facturascripts","fixedVersion":"2025.81"}],"fix":{"url":"https://github.com/NeoRazorX/facturascripts/commit/9066e10326029adf012114e27eb5f3f33f78ecfd","label":"NeoRazorX/facturascripts@9066e10"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27964.json"},{"type":"ADVISORY","url":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-gq5c-rw37-g46c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27964"},{"type":"FIX","url":"https://github.com/NeoRazorX/facturascripts/commit/9066e10326029adf012114e27eb5f3f33f78ecfd"},{"type":"PACKAGE","url":"https://github.com/NeoRazorX/facturascripts"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:58.296066678Z"}}