FacturaScripts contains an authenticated SQL injection vulnerability in its REST API filter parameter. The flaw allows an attacker with limited API access to inject SQL via specially crafted filter keys containing parentheses, bypassing identifier escaping. This leads to leakage of sensitive data such as admin password hashes and session cookies, enabling full account takeover without UI session or second factor. The vulnerability is fixed in version 2026.2.