SQL injection in FacturaScripts - #VU163134
Published: November 9, 2026
Vulnerability identifier: #VU163134
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged authenticated attacker to extract sensitive database contents through blind SQL injection in FacturaScripts.
The vulnerability exists due to missing field-name validation in the autocomplete endpoint's JoinModel branch, which inserts request-controlled field names containing parentheses directly into SQL queries. A low-privileged authenticated attacker with access to a List or Panel controller can submit crafted autocomplete requests and use blind extraction to retrieve customer data and authentication secrets.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.65