A3factura Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified on the A3factura web platform, specifically in version 4.111.2-rev.1. The issue arises in the 'customerVATNumber' parameter within the 'salesDeliveryNotes' endpoint. This vulnerability could allow an attacker to execute arbitrary code in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to A3factura version 4.114.0-rev.6, released on February 17, 2026, to address this vulnerability.