CVE-2026-25514 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions
Authenticated attackers can exploit SQL injection in autocomplete actions to extract sensitive database data, including credentials and business records.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25514?
CVE-2026-25514 is a high-severity SQL injection vulnerability in NeoRazorX facturascripts, published on 4 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.
Which versions are affected by CVE-2026-25514?
2 open source packages ship an affected version, including facturascripts/facturascripts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
facturascripts/facturascripts Packagist | All versions | 2025.81 |
facturascripts/facturascripts Packagist | All versions | 2025.81 |
Products include Facturascripts Facturascripts.
How do I fix CVE-2026-25514?
Upgrade facturascripts/facturascripts to 2025.81 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-25514 being exploited?
There is no known exploitation of CVE-2026-25514 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in NeoRazorX facturascripts
- CVE-2022-1571 Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts
- CVE-2022-1715 Account Takeover in neorazorx/facturascripts
- CVE-2022-1682 Reflected Xss using url based payload in neorazorx/facturascripts
- CVE-2022-1514 Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts
- CVE-2022-1457 Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts
Sources
Also known as GHSA-pqqg-5f4f-8952.