SQL injection in FacturaScripts - CVE-2026-45262
Published: November 9, 2026
Vulnerability identifier: #VU163112
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45262
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to retrieve sensitive database contents and take over an administrator account in FacturaScripts.
The vulnerability exists due to missing validation of REST API filter keys and an identifier-escaping bypass for keys containing parentheses. A low-privileged remote attacker with a read-only API key for one resource can submit crafted filters when API access is enabled, exposing administrator password hashes and reusable session tokens.
Affected software
FacturaScripts
How to mitigate CVE-2026-45262
Install security update from vendor's website.
FacturaScripts - update to 2026.2