A3factura’s web platform contains a reflected Cross‑Site Scripting flaw that appears when a malicious value is supplied in the ‘customerName’ parameter on the /incomes/salesInvoices endpoint. Because the input is echoed back without proper encoding, a crafted request can cause the victim’s browser to execute arbitrary JavaScript. This vulnerability enables an attacker to run code within the victim’s session but does not affect the server directly.

The affected product is A3factura version 4.111.2‑rev.1, released by A3factura and its partner Wolters Kluwer. A security fix was deployed in version 4.114.0‑rev.6 on 17 Feb 2026. Users running any earlier releases remain vulnerable.

The CVSS score of 4.8 classifies the flaw as moderate, while the EPSS score of < 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to entice a victim to click a crafted link or submit a form that injects a malicious ‘customerName’ value; the attack is limited to the victim’s browser and does not facilitate higher‑level compromise or server‑side damage.