FacturaScripts vulnerable to stored XSS via product reference in sales/purchases (CVE-2026-42877) | HOL Guard CVE