FacturaScripts 2025.61 contains a stored Cross‑Site Scripting flaw arising from inadequate validation of the ‘city’ and ‘province’ fields in the ListAlmacen endpoint. By inserting malicious JavaScript, an attacker can execute arbitrary code in the victim’s browser, potentially hijacking the session or elevating a normal user to administrator status by retrieving CSRF tokens, even when httpOnly cookies are in use. This vulnerability falls under OWASP CWE‑79 and can compromise confidentiality and integrity of the system.

All installations of FacturaScripts version 2025.61, and any earlier releases that include the same ListAlmacen implementation, are affected. The vulnerability is specific to the city/province data handling routines in the listed endpoint.

The CVSS score of 6.9 indicates a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is via web input to the ListAlmacen endpoint; however, this inference is made because the official description does not explicitly detail the attack path.