Read the docs
TI-2026-20624 Aliases CVE-2026-25514GHSA-pqqg-5f4f-8952

FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed facturascripts (NeoRazorX): 2025.81facturascripts/facturascripts (Packagist): 2025.81

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NeoRazorXfacturascriptsbefore 2025.812025.81Patch availableCNA
—facturascripts/facturascripts (Packagist)before 2025.812025.81Patch availableGHSA-pqqg-5f4f-8952
  • facturascripts VendorNeoRazorX Affected before 2025.81 Fixed in 2025.81 Patch available CNA
  • facturascripts/facturascripts (Packagist) Vendor— Affected before 2025.81 Fixed in 2025.81 Patch available GHSA-pqqg-5f4f-8952

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:*before 2025.81VulnerableNeoRazorX
  • cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:* Versions before 2025.81 Vulnerable ·NeoRazorX

Remediation

  • Fix · CNA facturascripts (NeoRazorX) Fixed in 2025.81
  • Fix · GHSA-pqqg-5f4f-8952 facturascripts/facturascripts (Packagist) Fixed in 2025.81 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25514
  2. 2026-10-03 Alias added: GHSA-pqqg-5f4f-8952

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-19336 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVSS 3.1CRITICAL 9.0
  • TI-2022-01581 Account Takeover in neorazorx/facturascripts CVSS 3.1CRITICAL 9.8
  • TI-2026-20623 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause CVSS 4.0HIGH 8.3
  • TI-2022-01913 Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
  • TI-2022-01843 Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
  • TI-2022-01550 Reflected Xss using url based payload in neorazorx/facturascripts CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences