A3factura Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified on the A3factura web platform, specifically in version 4.111.2-rev.1. The issue arises in the 'customerName' parameter within the 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint. This vulnerability could enable an attacker to execute arbitrary code in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute arbitrary code in the victim's browser.

Remediation

Users can upgrade to A3factura version 4.114.0-rev.6, released on February 17, 2026, to address this vulnerability.