SQL injection in FacturaScripts - #VU163127
Published: November 9, 2026
Vulnerability identifier: #VU163127
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated low-privilege attacker to extract sensitive database contents from FacturaScripts, including administrator password hashes and API keys.
The vulnerability exists due to unvalidated concatenation of the fieldcode parameter into SQL queries by Variante::codeModelSearch() when autocomplete requests specify source=Variante. A remote authenticated low-privilege attacker can submit a crafted request through an accessible List or Panel controller and retrieve arbitrary database values directly in the autocomplete response.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.65