NeoRazorX

6 results · Clear filters · Feed

• High 8.1
  CVE-2026-104905 Public exploit

  FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

  FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. A…

  NeoRazorX facturascripts
  Oct 5, 2026
• Medium 6.3
  CVE-2026-42879 Public exploit

  FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

  FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a P…

  NeoRazorX facturascripts facturascripts/facturascripts Packagist
  May 27, 2026
• Medium 5.3
  CVE-2026-32699 Public exploit

  FacturaScripts unauthorized modification of immutable nick field via EditUser controller

  FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field…

  NeoRazorX facturascripts facturascripts/facturascripts Packagist
  May 5, 2026
• High 8.3
  CVE-2026-25513 Public exploit

  FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause

  FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries t…

  NeoRazorX facturascripts facturascripts/facturascripts Packagist
  Feb 4, 2026
• High 8.7
  CVE-2026-25514 Public exploit

  FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

  FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensi…

  NeoRazorX facturascripts facturascripts/facturascripts Packagist
  Feb 4, 2026
• Low 1.2
  CVE-2025-69210 Public exploit

  FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

  FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files co…

  NeoRazorX facturascripts facturascripts/facturascripts Packagist
  Dec 30, 2025