CVE-2026-45710

Name of the Vulnerable Software and Affected Versions facturascripts (affected versions not specified)

Description Stored Cross-Site Scripting (XSS) exists due to improper sanitization of user-controlled input when rendering HTML attributes. The functions renderVariantList() in WidgetVariante.php and renderSubaccountList() in WidgetSubcuenta.php concatenate the referencia and codsubcuenta variables directly into JavaScript string literals within onclick attributes. Although the software uses Tools::noHtml to encode apostrophes as ', browsers decode HTML entities before the JavaScript is executed, allowing an attacker to break out of the string literal and execute arbitrary code.

An attacker can plant a payload through the EditProducto interface, direct database writes, or API imports. The execution occurs in the browser of any user who opens the variant or subaccount picker modal and interacts with the affected row. This can lead to session hijacking, theft of CSRF tokens, and full administrative compromise if an administrator is the victim.

Recommendations For the affected versions, replace the direct concatenation in WidgetVariante.php and WidgetSubcuenta.php with a data-attribute pattern. Specifically, use html entity decode followed by htmlspecialchars to normalize and encode the referencia and codsubcuenta variables, then access these values via this.dataset in the JavaScript call.

As a temporary mitigation, restrict access to the EditProducto permission and API import endpoints to trusted users only to prevent the planting of malicious payloads.