S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
medium·Misconfiguration·Updated Aug 30, 2026

CVE-2026-42878 Scanner

CVE-2026-42878 Scanner - Information Disclosure vulnerability in FacturaScripts

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsurl
CostFree
3
Times Used
continuous scan runs
6.1k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2026-42878
5.3
CVSSmedium
Exploitable remotely over the internet · no authentication required.

FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
facturascriptsby NeoRazorX
< v2026
Updated Sep 10, 2026View on NVD →
Detail

FacturaScripts is an open-source web-based application used by businesses for accounting and billing solutions. It's primarily used by small to medium-sized enterprises looking to manage their financial records effectively. The software is designed for flexibility and customization, catering to various business needs such as invoicing, inventory, and payroll management. Users appreciate its community-driven development model and open-source nature, allowing enhancements and integrations with other tools. The application is web-accessible, making it convenient for administrators who need to access data remotely. Despite its utility, security remains a crucial aspect, necessitating regular updates to protect sensitive business data.

The vulnerability in FacturaScripts allows remote attackers to access sensitive PHP configuration and environment variables. Attackers exploiting this issue can retrieve critical information, potentially exposing credentials and secrets. It's a significant concern because the vulnerability can be exploited without any form of authentication if the installation endpoint is exposed. Since PHP configuration files often hold sensitive configuration data, this flaw doesn't just expose technical details but may also compromise the security posture of the affected systems. Awareness and timely updates are crucial for maintaining the integrity and confidentiality of business data.

This specific Information Disclosure vulnerability affects the 'Installer' controller in FacturaScripts. The vulnerability is triggered when a request to the installer with the parameter `phpinfo=TRUE` results in the PHP info page being displayed. Without proper authentication checks, an attacker can easily access this endpoint, making it a critical exposure point. As the application exposes this information before installation completion, it demonstrates a clear security gap in the initial setup process of FacturaScripts. The combination of public exposure of PHP configuration and potential sensitive data highlights the need to align development practices with recommended security controls.

Possible effects of this vulnerability range from mere exposure of PHP configuration to more severe implications like credential theft. Attackers obtaining PHP configuration details can craft more targeted attacks, compromising systems based on observed configurations. Moreover, if any sensitive data like database connections or secret keys are exposed, it could lead to unauthorized access or data breaches. Such vulnerabilities present a gateway to further exploit chains, underscoring the importance of diligent security checks in every software deployment phase.

REFERENCES

Solution Advice
  • Update to FacturaScripts version 2026 or later to patch the vulnerability.
  • Limit exposure of the installation endpoint using firewall rules or access restrictions.
  • Edit server configurations to disable phpinfo unless needed, and ensure it is restricted to authorized personnel only.
  • Conduct regular security audits to identify and mitigate unauthorized exposures promptly.
  • Employ network security tools to detect and block unauthorized access attempts.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

CVE-2026-42878 Scanner - Information Disclosure vulnerability in FacturaScripts | S4E