FacturaScripts contains a reflected XSS flaw that surfaces when an attacker triggers a database error by supplying malicious input. The error message is rendered with the Twig | raw filter, which bypasses HTML escaping and allows the attacker to inject arbitrary JavaScript. This can lead to the execution of attacker‑controlled code in the victim’s browser, potentially stealing session cookies, defacing the page, or conducting further attacks.

Any deployment of NeoRazorX FacturaScripts with a version prior to 2025.8 is vulnerable. No specific sub‑version is singled out; the issue affects the entire codebase that handles error rendering.

The CVSS score of 5.4 classifies the vulnerability as moderate. The EPSS score is below 1%, indicating a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote via web input; exploitation requires ability to supply crafted data to an endpoint that can trigger a database error and expose the error message to the browser. Successful exploitation would provide only client‑side effects, such as session hijacking or defacement, not direct code execution on the server.