PT-2026-6306 · Unknown · Facturascripts

Lukasz-Rybak · CVE-2026-25514 · Published 2026-02-03 · Updated 2026-02-23

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2025.81

Description FacturaScripts is enterprise resource planning and accounting software. Versions prior to 2025.81 contain a critical SQL injection issue in the autocomplete functionality. Authenticated attackers can extract sensitive data from the database, including user credentials, configuration settings, and business data. The issue is located in the CodeModel::all() method, where user-supplied parameters are directly concatenated into SQL queries without proper sanitization or parameterized binding.

Recommendations Update to version 2025.81 or later.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-20

CWE-89

CWE-943

Related Identifiers

CVE-2026-25514

GHSA-PQQG-5F4F-8952

Affected Products

Facturascripts

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25514.json · Exploit
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pqqg-5f4f-8952 · Vendor Advisory
• https://github.com/NeoRazorX/facturascripts/commit/5c070f82665b98efd2f914a4769c6dc9415f5b0f · Patch
• https://osv.dev/vulnerability/GHSA-pqqg-5f4f-8952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25514 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25514 · Vendor Advisory
• https://github.com/NeoRazorX/facturascripts · Note
• https://reddit.com/r/VulnMatter/comments/1qvcw0u/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://t.me/cveNotify/152870 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1qvcy3d/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1qvcxbd/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1qvcyij/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://twitter.com/CVEnew/status/2019182780010422614 · Twitter Post
• https://t.me/CVEtracker/43756 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1qvczeq/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post