Dashboard / CVE-2026-104905

CVE-2026-104905

MEDIUM 1 PoC
MEDIUM Priority: 0.03 BB Relevance: 72/100
Published: 2026-10-05 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: Present
VC: None
VI: High
VA: High

Description

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
NeoRazorX facturascripts 2025.7 < 2026.7

References & Advisories (3)

Proof of Concept (1)

★ 1
https://github.com/wvllxe/CVE-2026-104905-facturascripts-object-injection
nomi-sec

Bug Bounty Relevance

72 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

6.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.51%
Raw Score 0.005070
Percentile 43.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00507
2026-11-12
0.00507
2026-11-10
0.00507
2026-11-09
0.00507
2026-11-08
0.00507

Intelligence Sources

mitre ref →

External Links