Skip to content
OpenAdvisories

Vendor

NeoRazorX

22 known vulnerabilities.

Products

facturascripts 13 neorazorx/facturascripts 9
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2026-104905 Public exploit

    FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

    FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. A…

    NeoRazorX facturascripts
  • High 7.2
    CVE-2026-27891

    Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism

    FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an atta…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • High 8.3
    CVE-2026-25513 Public exploit

    FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries t…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • High 8.7
    CVE-2026-25514 Public exploit

    FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensi…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • High 8.0
    CVE-2026-23997

    FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View

    FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data …

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • High 7.1
    CVE-2022-2066

    Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts

    Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.

    NeoRazorX neorazorx/facturascripts facturascripts/facturascripts Packagist
  • High 8.6
    CVE-2022-2065

    Cross-site Scripting (XSS) - Stored in neorazorx/facturascripts

    Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.

    NeoRazorX neorazorx/facturascripts facturascripts/facturascripts Packagist