A reflected cross‑site scripting vulnerability exists in the A3factura web application where the input parameter ‘name’ is echoed without proper encoding in the representative management page. If exploited, an attacker can embed malicious JavaScript that executes in the victim’s browser, enabling the execution of arbitrary code.

The flaw is present in A3factura’s web platform, specifically on version 4.111.2‑rev.1 (both the A3factura and Wolters Kluwer distribution). Patch version 4.114.0‑rev.6 contains the remediation and was released on 17 February 2026.

The CVSS score is 4.8, indicating a low severity risk. The EPSS score is below 1%, implying a very low probability of active exploitation, and the entry is not listed in the CISA KEV catalog. The attack vector is likely a benign‑looking URL that a victim is tricked into visiting; no authentication or privileged access is required. An attacker can target any user who visits the crafted link, while the damage is confined to the victim’s browser session.