FacturaScripts Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in FacturaScripts accounting and invoicing software, affecting versions through 2025.7. The issue arises in the fsNick cookie parameter, which is reflected into the HTML without proper sanitization. Although the server rejects modified sessions and forces a logout, the unsanitized HTML payload is executed in the browser immediately upon loading, before the logout can take effect.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the application with a valid account. Capture the GET request and modify the fsNick cookie value to include a JavaScript payload, such as a script tag with an alert command. Send the modified request, and the injected script will execute in the browser.

Remediation

Users should update to FacturaScripts version 2025.8, where this vulnerability has been fixed.