PT-2026-6306 · Unknown · Facturascripts

Lukasz-Rybak · Published 2026-02-03 · Updated 2026-02-23 · CVE-2026-25514

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2025.81

Description FacturaScripts is enterprise resource planning and accounting software. Versions prior to 2025.81 contain a critical SQL injection issue in the autocomplete functionality. Authenticated attackers can extract sensitive data from the database, including user credentials, configuration settings, and business data. The issue is located in the CodeModel::all() method, where user-supplied parameters are directly concatenated into SQL queries without proper sanitization or parameterized binding.

Recommendations Update to version 2025.81 or later.

Exploit

Fix

SQL injection

RCE

Weakness Enumeration

CWE-89

CWE-943

CWE-20

Related Identifiers

CVE-2026-25514

GHSA-PQQG-5F4F-8952

Affected Products

Facturascripts

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25514.json · Exploit
• https://github.com/NeoRazorX/facturascripts/commit/5c070f82665b98efd2f914a4769c6dc9415f5b0f · Patch
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pqqg-5f4f-8952 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pqqg-5f4f-8952 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25514 · Security Note
• https://github.com/NeoRazorX/facturascripts · Note
• https://reddit.com/r/VulnMatter/comments/1qvcy3d/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://t.me/cveNotify/152870 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1qvcw0u/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://t.me/CVEtracker/43756 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1qvcxbd/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1qvcyij/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://twitter.com/CVEnew/status/2019182780010422614 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1qvczeq/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post