/Vulnerability Library

FacturaScripts - Unauthenticated phpinfo Disclosure

CVE-2026-42878
Verified

Description

Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo() when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication.

Severity

Medium

CVSS Score

5.3

Exploit Probability

1%

Affected Product

facturascripts

Published Date

August 24, 2026

Template Author

chrisjr404

CVE-2026-42878.yaml
5.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2026-42878
CWE ID:
cwe-200

References

https://github.com/advisories/GHSA-vrxf-vrc4-22p7https://github.com/NeoRazorX/facturascripts/blob/master/Core/Controller/Installer.phphttps://nvd.nist.gov/vuln/detail/CVE-2026-42878

Remediation Steps

Update to version 2026 or later.