FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
FacturaScripts versions 2025.92 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability in the product search modal used in sales and purchase documents. An authenticated user with warehouse module access can inject malicious JavaScript via the product reference field, which executes in the browsers of other users opening the modal. This vulnerability allows limited impact on confidentiality and integrity but does not affect availability. No official patch or remediation guidance is currently confirmed.
FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.
FacturaScripts versions prior to 2026 contain an unauthenticated information disclosure vulnerability in the Installer controller. An attacker can remotely trigger the phpinfo() function by requesting /? phpinfo=TRUE on a fresh deployment, exposing detailed PHP configuration, server environment variables, filesystem paths, and loaded extensions. This exposure may include sensitive data such as database credentials, API keys, or application secrets if set as environment variables. The vulnerability is fixed in version 2026. The CVSS score is 5.3, indicating a medium severity level.
FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8.
FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could extract the uploader's embedded metadata, which included GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata. Of all FacturaScripts' image upload features, only the Library module combined unrestricted uploads, persistent storage, authenticated download access, and a total lack of server-side metadata sanitization. This vulnerability carries significant real-world impact: an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access. This issue has been fixed in version 2026.
FacturaScripts versions 2026 and below contain a critical vulnerability in the Plugins::add() function that allows a Zip Slip attack via improper validation of file paths in uploaded ZIP archives. This flaw enables an attacker to perform arbitrary file writes and remote code execution by overwriting sensitive PHP files outside the intended plugins directory. The vulnerability arises because the testZipFile function only checks for a single root folder but does not sanitize file paths within that folder, allowing path traversal sequences like .. /.. / to escape the directory. This issue is fixed in version 2026.1.
FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.
CVE-2026-25513 is a high-severity SQL injection vulnerability in FacturaScripts ERP and accounting software versions prior to 2025.81. It affects the REST API's sorting functionality, where user input in the sort parameter is unsafely concatenated into SQL ORDER BY clauses without validation. Authenticated API users can exploit this flaw to execute arbitrary SQL commands, potentially compromising data confidentiality and integrity. The vulnerability has been patched in version 2025.81. No known exploits are reported in the wild yet. European organizations using affected versions of FacturaScripts should prioritize updating to mitigate risks. The vulnerability requires authentication but no user interaction, and it impacts all API endpoints supporting sorting. This threat is particularly relevant to countries with significant SME adoption of FacturaScripts and those with critical accounting and ERP infrastructure relying on this software.
CVE-2026-25514 is a critical SQL injection vulnerability in FacturaScripts versions prior to 2025.81, affecting the autocomplete functionality. It allows authenticated attackers to execute arbitrary SQL queries by exploiting improper input validation in the CodeModel::all() method, leading to potential extraction of sensitive data such as user credentials, configuration settings, and business data. The vulnerability requires authentication but no user interaction and has a high CVSS score of 8.7. Although no known exploits are reported in the wild yet, the impact on confidentiality, integrity, and availability is significant. The issue has been patched in version 2025.81. European organizations using FacturaScripts should prioritize updating to the patched version and implement strict input validation and database query parameterization to mitigate risks. Countries with higher adoption of FacturaScripts and significant SME sectors relying on ERP/accounting software are more likely to be affected.
CVE-2026-23476 is a reflected cross-site scripting (XSS) vulnerability in FacturaScripts, an open-source ERP and accounting software by NeoRazorX, affecting versions prior to 2025.8. The flaw arises from improper sanitization when displaying error messages triggered by database input errors, due to the use of Twig's | raw filter which bypasses HTML escaping. An attacker can exploit this by causing a database error with crafted input, leading to execution of malicious scripts in the victim's browser. The vulnerability requires low privileges but does require user interaction and results in partial confidentiality and integrity impact without affecting availability. It is rated medium severity with a CVSS score of 5.4 and has no known exploits in the wild. The issue is fixed in version 2025.8. European organizations using vulnerable versions of FacturaScripts, especially in finance and accounting roles, should prioritize patching to prevent potential targeted attacks.
CVE-2026-23997 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability affecting FacturaScripts versions 2025.71 and earlier. The flaw exists in the Observations field within the History view, where user input is rendered without proper HTML entity encoding, allowing attackers to inject and execute arbitrary JavaScript in the browsers of administrators viewing the history. Exploitation requires at least limited privileges to input data and some user interaction to trigger the payload. The vulnerability impacts confidentiality, integrity, and availability by enabling session hijacking, credential theft, or administrative account compromise. No known exploits are currently reported in the wild. European organizations using FacturaScripts for ERP and accounting functions are at risk, especially those with administrators accessing the affected History view. Mitigation requires applying patches once available, implementing strict input validation and output encoding, and restricting access to the History view to trusted users. Countries with significant SME adoption of FacturaScripts, such as Spain, Germany, France, Italy, and the UK, are most likely affected due to market penetration and the strategic importance of ERP systems. Given the CVSS 3.
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed. Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session. Version 2025.7 fixes the issue.
