A3factura Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified on the A3factura web platform, specifically in version 4.111.2-rev.1. The issue arises in the 'name' parameter of the 'representatives-management' endpoint, located at 'a3factura-app.wolterskluwer.es/#/incomes/representatives-management'. This vulnerability could allow an attacker to execute arbitrary code in the victim's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute scripts in the context of the user's browser.

Remediation

Users can upgrade to A3factura version 4.114.0-rev.6, released on February 17, 2026, to address this vulnerability.