CVE-2026-2678 — Multiple vulnerabilities in A3factura software

CVE-2026-2678

Multiple vulnerabilities in A3factura software PUBLISHED

Description (CNA)

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', parameter 'name', in 'a3factura-app.wolterskluwer.es/#/incomes/customers' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.

Affected (CNA)

Vendor / product	Versions
A3factura / A3factura	affected 4.111.2-rev.1

CWE

CWE-79

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-a3factura-software

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.