PT-2026-6305 · Unknown · Facturascripts

Lukasz-Rybak · CVE-2026-25513 · Published 2026-02-03 · Updated 2026-02-23

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2025.81

Description FacturaScripts, an open-source enterprise resource planning and accounting software, contains a critical SQL injection issue in its REST API. Authenticated API users can execute arbitrary SQL queries through the sort parameter. The issue resides in the getOrderBy() method of the ModelClass, where user-supplied sorting parameters are directly incorporated into the SQL ORDER BY clause without proper validation or sanitization. This impacts all API endpoints that support sorting functionality.

Recommendations Update to version 2025.81 or later.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-20

CWE-89

CWE-943

CWE-1286

Related Identifiers

CVE-2026-25513

GHSA-CJFX-QHWM-HF99

Affected Products

Facturascripts

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25513.json · Exploit
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-cjfx-qhwm-hf99 · Vendor Advisory
• https://github.com/NeoRazorX/facturascripts/commit/1b6cdfa9ee1bb3365ea4a4ad753452035a027605 · Patch
• https://osv.dev/vulnerability/GHSA-cjfx-qhwm-hf99 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25513 · Security Note
• https://github.com/NeoRazorX/facturascripts · Note
• https://t.me/CVEtracker/43755 · Telegram Post
• https://twitter.com/CVEnew/status/2019182779158942197 · Twitter Post
• https://t.me/cveNotify/152869 · Telegram Post