SQL injection in FacturaScripts - #VU163129
Published: November 9, 2026
Vulnerability identifier: #VU163129
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged attacker to read arbitrary database tables beyond an API key's authorized scope, exposing password hashes and secrets.
The vulnerability exists due to missing validation of the operation query parameter used as an SQL filter connector in the FacturaScripts REST API. A low-privileged attacker can inject SQL to bypass query constraints using a scoped API key with read access when the normally disabled REST API is enabled.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.7