CVE-2026-25514

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2025.81

Description FacturaScripts is enterprise resource planning and accounting software. Versions prior to 2025.81 contain a critical SQL injection issue in the autocomplete functionality. Authenticated attackers can extract sensitive data from the database, including user credentials, configuration settings, and business data. The issue is located in the CodeModel::all() method, where user-supplied parameters are directly concatenated into SQL queries without proper sanitization or parameterized binding.

Recommendations Update to version 2025.81 or later.