CVE-2026-23997 is a stored cross-site scripting flaw (CVSS 8.0) in FacturaScripts, the open source ERP and accounting software, in version 2025.71 and earlier. Data in the Observations field is shown in the History view without encoding, so script can run for administrators. The advisory lists no patched version, so limit editing rights.
What's affected
FacturaScripts 2025.71, per the GitHub advisory, with earlier versions also covered by the record. The advisory lists no patched version at the time of the page I read, so check the project's releases and advisory for a newer fix.
How to check if you're exposed
Check the version shown in the admin interface or in your installation files. Then identify who can write to fields that appear in the History view, such as Observations. Users with that permission can store text that is later displayed to an administrator.
What to do now
- Check the FacturaScripts releases for a version newer than 2025.71 that references this advisory, and upgrade once one exists.
- Limit who can create or edit records with free text fields to people you trust.
- Ask administrators to use a separate, minimal browser profile for the admin interface.
- Add a Content Security Policy at your reverse proxy if you can, to limit what injected script can load or send.
- Review the History entries for unexpected markup.
Why it matters
The weakness is CWE-79, cross-site scripting. The stored kind is more serious than reflected, because the payload waits in the database until a privileged user opens the page. In an accounting system, an administrator session reaches financial records.
The fix is output encoding at the place where history data is rendered. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 8.0, published 2026-02-02. In the vector, the attacker works over the network, needs a low privilege account, and the attack is low in complexity. User interaction is required. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Quick check
Why is stored XSS rated higher than a reflected one?
It does not need the victim to click a crafted link. It needs only that they view a page that shows the stored data.
Sources
Last reviewed: 19 October 2026.
