Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2026-25514 EUVD-2026-5360GHSA-pqqg-5f4f-8952

FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

Published Feb 4, 2026 · Updated Feb 5, 2026 · Assigned by GitHub_M

Vendor: NeoRazorX Product: facturascripts Package: facturascripts/facturascripts Ecosystem: Packagist

Description

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.

Affected products

VendorProductAffectedFixed
NeoRazorX facturascripts < 2025.81 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist facturascripts/facturascripts < 2025.81 2025.81 GHSA-pqqg-5f4f-8952

References