A stored Cross‑Site Scripting flaw is present in the Observations field of the History view. Historical data is rendered without proper HTML entity encoding, enabling an attacker to insert malicious JavaScript that executes when an administrator opens the history screen. The immediate effect is the ability to run code in the context of the administrator’s browser, which can lead to session hijacking, data exfiltration, or further compromise of the application. The vulnerability directly affects the confidentiality, integrity, and availability of managerial data and the user session.

The software affected is FacturaScripts, produced by NeoRazorX, specifically versions 2025.71 and earlier. Upgrading beyond 2025.71 removes the flaw.

The CVSS score of 8 categorizes this vulnerability as high severity; the EPSS score is under 1%, indicating a low probability of exploitation at present. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers need to inject code into the Observations field to place the payload, which likely requires user privileges that allow adding or editing history entries. Once the payload is stored, any administrator who views the history will have their browser's script engine execute the injected code. The primary attack vector is the web application interface, with precedence on successful authentication and permission to view history.