The CVE describes a stored Cross‑Site Scripting flaw in the product search modal of sales and purchases documents in FacturaScripts 2025.92 and earlier. An authenticated user with access to the warehouse module can create a product whose reference contains malicious JavaScript. When another authenticated user opens the product search modal, the script runs in that user’s browser, allowing arbitrary code execution.

The flaw affects the NeoRazorX FacturaScripts application for versions 2025.92 and older. It is present in the product search modal used for sales and purchases documents and requires the warehouse module to be enabled as well as permissions to create products.

The CVSS score of 5.4 indicates moderate severity and the necessity of authentication. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user who has permission to create products in the warehouse module; after inserting a malicious product reference, any other user who opens the search modal will have the script executed.