High severity · published Feb 4, 2026
CVE-2026-25513
FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
facturascripts · NeoRazorX
< 2025.81 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25513
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25513
Patch
https://github.com/NeoRazorX/facturascripts/commit/1b6cdfa9ee1bb3365ea4a4ad753452035a027605
Exploit
https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-cjfx-qhwm-hf99
More from facturascripts
9.0
CVE-2026-23997
FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View
8.8
CVE-2026-25514
FacturaScripts has SQL Injection vulnerability in Autocomplete Actions
8.1
CVE-2026-104905
FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
7.2
CVE-2026-27891
Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
6.5
CVE-2026-27892
FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download