Vulnerability · Published Feb 4, 2026 · Assigned by GitHub_M
CVE-2026-25513FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause
High 8.3
In plain English
A high-severity SQL injection in facturascripts from NeoRazorX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | facturascripts/facturascripts | 2025.81 | GHSA-cjfx-qhwm-hf99 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NeoRazorX | facturascripts | < 2025.81 |
Weakness: CWE-89, CWE-20, CWE-1286, CWE-943 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N