Factionsecurity vulnerabilities
We track 5 vulnerabilities in Factionsecurity products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on May 26, 2026.
Latest Factionsecurity vulnerabilities
- 8.7 High severity
faction: Improper Neutralization of Input During Web Page Generation
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in assessment file preview flows. User-supplied filename values are persisted and later r
- 9.8 Critical severity
faction: Missing Authentication for Critical Functionality
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action method
- 8.7 High severity
faction: Improper Neutralization of Input During Web Page Generation
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in remediation verification file preview flows. User-supplied filename values are persist
- 9.8 Critical severity
faction: Missing Authorization
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hoo
- 7.5 High severity
faction: Improper Authentication
FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules