A3factura Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified on the A3factura web platform, specifically in version 4.111.2-rev.1. The issue arises in the 'name' parameter within the 'a3factura-app.wolterskluwer.es/#/incomes/customers' endpoint. This vulnerability could allow an attacker to execute arbitrary code in the browser of the victim.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute arbitrary code in the victim's browser.

Remediation

Users can upgrade to A3factura version 4.114.0-rev.6, released on 17/02/2026, to address this vulnerability.