FacturaScripts is an open-source ERP and accounting software widely used by small and medium enterprises for managing business processes. CVE-2026-25514 is a critical SQL injection vulnerability found in versions prior to 2025.81, specifically in the autocomplete feature implemented in the CodeModel::all() method. The root cause is improper input validation where user-supplied parameters are directly concatenated into SQL queries without sanitization or use of parameterized queries, violating secure coding practices (CWE-20, CWE-89, CWE-943). An authenticated attacker can exploit this flaw to inject malicious SQL commands, enabling unauthorized extraction of sensitive data including user credentials, configuration details, and all stored business data. The vulnerability does not require user interaction but does require the attacker to have valid credentials, which lowers the attack complexity but still poses a high risk due to the extensive data exposure possible. The vulnerability has been assigned a CVSS 4.0 base score of 8.7, reflecting its high impact on confidentiality, integrity, and availability. Although no active exploitation has been reported, the critical nature of the flaw and the sensitive data involved necessitate immediate remediation. The vendor has addressed the issue in version 2025.81 by implementing proper input validation and parameterized queries to prevent SQL injection.

For European organizations, especially SMEs relying on FacturaScripts for ERP and accounting, this vulnerability poses a significant risk of data breach and operational disruption. Exploitation could lead to unauthorized disclosure of sensitive business information, including financial records and user credentials, potentially resulting in financial loss, reputational damage, and regulatory non-compliance under GDPR. The integrity of business data could be compromised, affecting decision-making and reporting accuracy. Availability could also be impacted if attackers manipulate database queries to disrupt service. Given the requirement for authentication, insider threats or compromised credentials increase the risk. Organizations in sectors with stringent data protection requirements, such as finance, healthcare, and manufacturing, are particularly vulnerable. The lack of known exploits currently provides a window for proactive mitigation before widespread attacks occur.

European organizations should immediately upgrade FacturaScripts to version 2025.81 or later to apply the official patch. In addition, implement multi-factor authentication (MFA) to reduce the risk of credential compromise. Conduct thorough audits of user access rights to limit authenticated users to necessary privileges only. Employ Web Application Firewalls (WAFs) with SQL injection detection rules tailored to FacturaScripts’ query patterns to provide an additional layer of defense. Review and harden database permissions to restrict the scope of potential SQL injection impacts. Regularly monitor logs for unusual query patterns or data access anomalies indicative of exploitation attempts. Educate users about credential security and monitor for compromised accounts. Finally, consider deploying runtime application self-protection (RASP) solutions that can detect and block injection attacks in real time.