Authenticated administrator takeover via unencoded history observations

Stored XSS in FacturaScripts 2025.71 and earlier allows remote authenticated users to run JavaScript when an administrator views History. The History view renders attacker-controlled Observations data without HTML entity encoding, so a saved event-handler payload executes in the administrator's browser session. A regular user needs note-editing permission and an administrator must open the affected record's History tab; the demonstrated consequence is administrator account takeover through a forged password-change request.