https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:48:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267433 EUVD-2026-267433 https://cve.radiocsirt.org/vuln/euvd-2026-267433 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25513 <p>FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.</p> <p>FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerability exists in the ModelClass::getOrderBy() method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects all API endpoints that support sorting functionality. This issue has been patched in version 2025.81.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25513 https://cve.radiocsirt.org/vuln/ghsa-cjfx-qhwm-hf99 <p><strong>Affected:</strong> Packagist: facturascripts/facturascripts</p> <p>### Summary **FacturaScripts contains a critical SQL Injection vulnerability in the REST API** that allows authenticated API users to execute arbitrary SQL queries through the `sort` parameter. The vulnerability exists in the `ModelClass::getOrderBy()` method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects **all API endpoints** that support sorting functionality.</p> <p>---</p> <p>### Details</p> <p>The FacturaScripts REST API exposes database models through various endpoints (e.g., `/api/3/users`, `/api/3/attachedfiles`, `/api/3/customers`). These endpoints support a `sort` parameter that allows clients to specify result ordering. The API processes this parameter through the `ModelClass::all()` method, which calls the vulnerable `getOrderBy()` function.</p> <p>#### Vulnerable Code Locations</p> <p>**1. Legacy Models:** **File:** `/Core/Model/Base/ModelClass.php` **Method:** `getOrderBy()` Direct concatenation of keys and values from the `$order` array.</p> <p>**2. Modern Models (DbQuery):** **File:** `/Core/DbQuery.php` **Method:** `orderBy()` **Lines:** 255-259 ```php // If it contains parentheses, it is not escaped (VULNERABILITY!) if (strpos($field, &#39;(&#39;) !== false &amp;&amp; strpos($field, &#39;)&#39;) !== false) { $this-&gt;orderBy[] = $field . &#39; &#39; . $order; return $this; } ``` This check is intended to allow SQL functions but fails to validate them, allowing arbitrary SQL Injection.…</p> <p><strong>Affected:</strong> Packagist: facturascripts/facturascripts</p> <p>### Summary **FacturaScripts contains a critical SQL Injection vulnerability in the REST API** that allows authenticated API users to execute arbitrary SQL queries through the `sort` parameter. The vulnerability exists in the `ModelClass::getOrderBy()` method where user-supplied sorting parameters are directly concatenated into the SQL ORDER BY clause without validation or sanitization. This affects **all API endpoints** that support sorting functionality.</p> <p>---</p> <p>### Details</p> <p>The FacturaScripts REST API exposes database models through various endpoints (e.g., `/api/3/users`, `/api/3/attachedfiles`, `/api/3/customers`). These endpoints support a `sort` parameter that allows clients to specify result ordering. The API processes this parameter through the `ModelClass::all()` method, which calls the vulnerable `getOrderBy()` function.</p> <p>#### Vulnerable Code Locations</p> <p>**1. Legacy Models:** **File:** `/Core/Model/Base/ModelClass.php` **Method:** `getOrderBy()` Direct concatenation of keys and values from the `$order` array.</p> <p>**2. Modern Models (DbQuery):** **File:** `/Core/DbQuery.php` **Method:** `orderBy()` **Lines:** 255-259 ```php // If it contains parentheses, it is not escaped (VULNERABILITY!) if (strpos($field, &#39;(&#39;) !== false &amp;&amp; strpos($field, &#39;)&#39;) !== false) { $this-&gt;orderBy[] = $field . &#39; &#39; . $order; return $this; } ``` This check is intended to allow SQL functions but fails to validate them, allowing arbitrary SQL Injection.…</p> https://cve.radiocsirt.org/vuln/ghsa-cjfx-qhwm-hf99