Vulnerabilidades do Facturascripts Facturascripts

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Facturascripts Facturascripts: 5 registro(s), com versões afetadas e correções.
cpe:2.3:a:facturascripts:facturascripts

CVE-2026-25514 Alta · 8.8 CWE-20 04/02/2026

FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.

CVE-2026-25513 Alta · 8.8 CWE-20 04/02/2026

FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.

CVE-2026-23997 Crítica · 9.0 CWE-79 02/02/2026

FacturaScripts: XSS armazenado no campo Observações (visualização de histórico)

O FacturaScripts é um software de planejamento de recursos empresariais e contabilidade de código aberto. Nas versões 2025.71 e anteriores, foi identificada uma vulnerabilidade de Cross-Site Scripting (XSS) armazenado no campo Observações. A falha ocorre na visualização de Histórico, onde dados históricos são renderizados sem a codificação adequada de entidades HTML. Isso permite que um atacante execute JavaScript arbitrário no navegador de administradores que visualizam o histórico.

CVE-2026-23476 Média · 5.4 CWE-79 02/02/2026

FacturaScripts Affected by Reflected XSS

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passing a string where an integer is expected), the error message includes the input and gets rendered without sanitization. This vulnerability is fixed in 2025.8.

CVE-2025-69210 Média · 5.4 Exploit público CWE-79 30/12/2025

FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.