CVE-2026-2679 MEDIUM

CVE-2026-2679: Multiple vulnerabilities in A3factura software

Vendor A3Factura

Product A3factura

Weakness CWE-79 · XSS

Published February 26, 2026

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

4.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.

Key dates

02Disclosure timeline

February 26, 2026 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-2679 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-23759 WordPress Affiliate Tools Việt Nam plugin <= 0.3.17 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-2655 Elementor Addons by Livemesh <= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name CVE-2024-3358 SourceCodester Aplaya Beach Resort Online Reservation System index.php cross site scripting CVE-2025-9107 Portabilis i-Diario search_autocomplete cross site scripting CVE-2025-47616 WordPress aBlocks plugin <= 1.9.2 - Cross Site Scripting (XSS) Vulnerability