CVE-2026-25513 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause
Authenticated users can execute arbitrary SQL queries via the sort parameter in the REST API, potentially accessing or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25513?
CVE-2026-25513 is a high-severity SQL injection vulnerability in NeoRazorX facturascripts, published on 4 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.
Which versions are affected by CVE-2026-25513?
2 open source packages ship an affected version, including facturascripts/facturascripts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
facturascripts/facturascripts Packagist | All versions | 2025.81 |
facturascripts/facturascripts Packagist | All versions | 2025.81 |
Products include Facturascripts Facturascripts.
How do I fix CVE-2026-25513?
Upgrade facturascripts/facturascripts to 2025.81 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-25513 being exploited?
There is no known exploitation of CVE-2026-25513 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in NeoRazorX facturascripts
- CVE-2022-1571 Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts
- CVE-2022-1715 Account Takeover in neorazorx/facturascripts
- CVE-2022-1682 Reflected Xss using url based payload in neorazorx/facturascripts
- CVE-2022-1514 Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts
- CVE-2022-1457 Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts
Sources
Also known as GHSA-cjfx-qhwm-hf99.