What is the CVSS score of CVE-2026-25514?

CVE-2026-25514 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Facturascripts are affected by CVE-2026-25514?

A high-severity vulnerability (CVE-2026-25514) affecting FacturaScripts ERP software poses significant risk to organizations using this platform for accounting and enterprise operations.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25514?

Yes, a public proof-of-concept exploit is available for CVE-2026-25514. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25514?

Within 24 hours: Identify all FacturaScripts instances in your environment and assess which are internet-facing or accessible to untrusted networks. Within 7 days: Apply the available vendor patch to all affected FacturaScripts installations, prioritizing production and customer-facing systems. Within 30 days: Complete patching of all remaining FacturaScripts deployments and validate patch effectiveness through vulnerability scanning.

Facturascripts CVE-2026-25514

HIGH

Improper Input Validation (CWE-20)

2026-02-04 security-advisories@github.com

GHSA-pqqg-5f4f-8952

SQLi Facturascripts

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 23, 2026 - 15:00 vuln.today

Public exploit code

Patch released

Feb 23, 2026 - 15:00 nvd

Patch available

CVE Published

Feb 04, 2026 - 20:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding. This issue has been patched in version 2025.81.

AnalysisAI

FacturaScripts is open-source enterprise resource planning and accounting software. [CVSS 8.8 HIGH]

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects the autocomplete component of Facturascripts. FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the CodeModel::all() method where user-supplied parameters are directly concatenated into SQL queries w

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 2025.81.. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.