Exploit for CVE-2026-104905

CVE-2026-104905 — PHP Object Injection in FacturaScripts Widg...

CVE-2026-104905

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

EUVD-2026-92525

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...

CVE-2026-104905

FacturaScripts versions prior to 2026.7 are vulnerable to a PHP object injection vulnerability within the WidgetSelect::processFormData() function. The root cause is the application's failure to apply an allowed_classes filter when calling unserialize() on raw POST data for multiple-select fields...

FacturaScripts - Unauthenticated phpinfo Disclosure

Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication. id: CVE-2026-42878 info: name:...

PT-2026-106051

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowed classes filter for multiple-select fields. Attackers can submit a serialized XLSXWrite...

CVE-2026-25513

CVE-2026-25513: FacturaScripts API ORDER BY 절의 SQL 인젝션 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2026-25513 심각도| HIGH 권고| 권고 보기 발견자| Lukasz Rybak 영향을 받는 제품 facturascripts/facturascripts 버전: ord...

CVE-2026-42879

CVE-2026-42879 - FacturaScripts - 인증된 사용자의 MIME 타입 우회를 통한 무제한 파일 업로드 요약 FacturaScripts의 제품 이미지 업로드 기능에 인증된 사용자의 무제한 파일 업로드 취약점이 존재합니다. 유효한 자격 증명을 가진 공격자는 GIF89a 헤더를 사용하여 PHP 파일을 GIF 이미지로 위장해 업로드함으로써 MIME 타입 검증을 우회할 수 있습니다. 파일은 원래 확장자.php와 같은 실행 가능한 확장자 포함로 저장됩니다. 세부 정보 취약점은 다음 위치에 존재합니다:...

CVE-2026-25514

CVE-2026-25514: FacturaScripts 자동완성Autocomplete 기능의 SQL 인젝션 취약점 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2026-25514 심각도| 높음HIGH 보안 권고| 권고 보기 발견자| Lukasz Rybak 영향을 받는 제품 facturascripts/facturascripts 버전: selectLimit$sql, self::getLimit as $row $result = new static$...

cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - FacturaScripts EditUser Nick 매개변수 취약한 접근 제어 설명 요약 이 애플리케이션은 EditUser 컨트롤러로 전송되는 POST 요청 중 nick 매개변수를 검증하지 않습니다. UI에서는 이 필드의 편집을 차단하지만, 사용자는 프록시를 사용하여 이 제한을 우회 하고 관리자 계정을 포함한 모든 계정의 이름을 변경 할 수 있습니다. 이로 인해 취약한 접근 제어Broken Access Control 및 잠재적인 감사 로그 손상Audit Log Corruption 이 발생합니다. ...

GHSA-HGJX-R89M-M7V4 FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

Summary FacturaScripts\Core\UploadedFile::move$destiny, $destinyName concatenates $destiny and $destinyName without normalizing the resulting path. Every caller in the codebase passes UploadedFile::getClientOriginalName — the unsanitized client-supplied filename — as $destinyName, so an...

CVE-2026-45693

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:10+00:00| published-proof-of-concept| https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-cv65-7cg8-r623...

CVE-2026-45710

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:03+00:00| published-proof-of-concept| https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3x7p-v8hj-xh5m...

GHSA-2P5X-4JR6-X5JG FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

Summary Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user lowpriv created a customer with nombre = "=SUM1+1cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payloa...

GHSA-CV65-7CG8-R623 FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents

Summary The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a ../ segment in the middle ends up serving a file from a differe...

GHSA-5QMH-X653-G8QJ FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

Summary Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A scoped ApiKey with fullaccess=0 and an ApiAccess row granting allowget=1 on the clientes resource only no other rights, no UI session, no admin issued one GET /api/3/clientes?filter0UNION%20SELECT%20.....

PT-2026-60066

Summary Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user lowpriv created a customer with nombre = "=SUM1+1cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payloa...

CVE-2026-32699

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction b...