Skip to content
OpenAdvisories

Product · NeoRazorX

facturascripts

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.1
    CVE-2026-104905 Public exploit

    FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

    FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. A…

    NeoRazorX facturascripts
  • Medium 6.3
    CVE-2026-42879 Public exploit

    FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

    FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a P…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Medium 5.3
    CVE-2026-32699 Public exploit

    FacturaScripts unauthorized modification of immutable nick field via EditUser controller

    FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • High 8.3
    CVE-2026-25513 Public exploit

    FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries t…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • High 8.7
    CVE-2026-25514 Public exploit

    FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensi…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Low 1.2
    CVE-2025-69210 Public exploit

    FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files co…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist