Read the docs
TI-2026-20623 Aliases CVE-2026-25513GHSA-cjfx-qhwm-hf99

FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause

Priority LOW 37CWE-1286Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed facturascripts (NeoRazorX): 2025.81facturascripts/facturascripts (Packagist): 2025.81

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NeoRazorXfacturascriptsbefore 2025.812025.81Patch availableCNA
—facturascripts/facturascripts (Packagist)before 2025.812025.81Patch availableGHSA-cjfx-qhwm-hf99
  • facturascripts VendorNeoRazorX Affected before 2025.81 Fixed in 2025.81 Patch available CNA
  • facturascripts/facturascripts (Packagist) Vendor— Affected before 2025.81 Fixed in 2025.81 Patch available GHSA-cjfx-qhwm-hf99

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*before 2025.81VulnerableNeoRazorX
  • cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:* Versions before 2025.81 Vulnerable ·NeoRazorX

Remediation

  • Fix · CNA facturascripts (NeoRazorX) Fixed in 2025.81
  • Fix · GHSA-cjfx-qhwm-hf99 facturascripts/facturascripts (Packagist) Fixed in 2025.81 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25513
  2. 2026-10-03 Alias added: GHSA-cjfx-qhwm-hf99

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-19336 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVSS 3.1CRITICAL 9.0
  • TI-2022-01581 Account Takeover in neorazorx/facturascripts CVSS 3.1CRITICAL 9.8
  • TI-2026-20624 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions CVSS 4.0HIGH 8.7
  • TI-2022-01913 Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
  • TI-2022-01843 Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
  • TI-2022-01550 Reflected Xss using url based payload in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences