PT-2026-6305 · Unknown · Facturascripts

Lukasz-Rybak · Published 2026-02-03 · Updated 2026-02-23 · CVE-2026-25513

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2025.81

Description FacturaScripts, an open-source enterprise resource planning and accounting software, contains a critical SQL injection issue in its REST API. Authenticated API users can execute arbitrary SQL queries through the sort parameter. The issue resides in the getOrderBy() method of the ModelClass, where user-supplied sorting parameters are directly incorporated into the SQL ORDER BY clause without proper validation or sanitization. This impacts all API endpoints that support sorting functionality.

Recommendations Update to version 2025.81 or later.

Exploit

Fix

SQL injection

RCE

Weakness Enumeration

CWE-89

CWE-943

CWE-1286

CWE-20

Related Identifiers

CVE-2026-25513

GHSA-CJFX-QHWM-HF99

Affected Products

Facturascripts

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25513.json · Exploit
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-cjfx-qhwm-hf99 · Vendor Advisory
• https://github.com/NeoRazorX/facturascripts/commit/1b6cdfa9ee1bb3365ea4a4ad753452035a027605 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25513 · Security Note
• https://osv.dev/vulnerability/GHSA-cjfx-qhwm-hf99 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25513 · Vendor Advisory
• https://github.com/NeoRazorX/facturascripts · Note
• https://t.me/CVEtracker/43755 · Telegram Post
• https://twitter.com/CVEnew/status/2019182779158942197 · Twitter Post
• https://t.me/cveNotify/152869 · Telegram Post