CVE-2025-69210: FacturaScripts is open-source enterprise resource planning and accounting software

Q: How do I fix CVE-2025-69210?

facturascripts: upgrade to 2025.7. Exact commands for each OS are on this page.

Q: Is CVE-2025-69210 being exploited?

CVE-2025-69210 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2025-69210 affect?

CVE-2025-69210 affects facturascripts. Severity is medium (CVSS 5.4). FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload c

Q: How urgent is CVE-2025-69210?

Priority 39/100. Public exploit reference

Routine

MEDIUM 5.4UPGRADE

CVE-2025-69210 is a medium-severity flaw (CVSS 5.4) affecting facturascripts. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	5.4 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	1.0% (top 38%)
CISA exploited list	No
Weakness	CWE-79
Published	2025-12-30
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: facturascripts

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-12-30 20:16 UTCPublished CVE record published
2026-06-17 10:00 UTCUpdated Record last modified

facturascripts facturascripts UPGRADE

Affected: < 2025.7

Fixed in: 2025.7

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy facturascripts || rpm -q facturascripts || facturascripts --version

2. UPGRADE to 2025.7 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade facturascripts

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade facturascripts

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: FacturaScripts 2025.43 - XSS

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-69210?

facturascripts: upgrade to 2025.7. Exact commands for each OS are on this page.

Is CVE-2025-69210 being exploited?

CVE-2025-69210 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-69210 affect?

CVE-2025-69210 affects facturascripts. Severity is medium (CVSS 5.4). FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload c

How urgent is CVE-2025-69210?

Priority 39/100. Public exploit reference

Related CVEs

CVE-2026-25514 HIGH 8.8 UPGRADE FacturaScripts is open-source enterprise resource planning and accounting software
CVE-2026-25513 HIGH 8.8 UPGRADE FacturaScripts is open-source enterprise resource planning and accounting software
CVE-2026-23997 HIGH 8.0 UPGRADE FacturaScripts is open-source enterprise resource planning and accounting software
CVE-2026-23476 MEDIUM 5.4 UPGRADE FacturaScripts is open-source enterprise resource planning and accounting software

References

← Back to latest CVEs