278 matches found
FacturaScripts - Unauthenticated phpinfo Disclosure
Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication. id: CVE-2026-42878 info: name:...
CVE-2026-25513
CVE-2026-25513: FacturaScripts API ORDER BY 절의 SQL 인젝션 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2026-25513 심각도| HIGH 권고| 권고 보기 발견자| Lukasz Rybak 영향을 받는 제품 facturascripts/facturascripts 버전: ord...
CVE-2026-42879
CVE-2026-42879 - FacturaScripts - 인증된 사용자의 MIME 타입 우회를 통한 무제한 파일 업로드 요약 FacturaScripts의 제품 이미지 업로드 기능에 인증된 사용자의 무제한 파일 업로드 취약점이 존재합니다. 유효한 자격 증명을 가진 공격자는 GIF89a 헤더를 사용하여 PHP 파일을 GIF 이미지로 위장해 업로드함으로써 MIME 타입 검증을 우회할 수 있습니다. 파일은 원래 확장자.php와 같은 실행 가능한 확장자 포함로 저장됩니다. 세부 정보 취약점은 다음 위치에 존재합니다:...
CVE-2026-25514
CVE-2026-25514: FacturaScripts 자동완성Autocomplete 기능의 SQL 인젝션 취약점 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2026-25514 심각도| 높음HIGH 보안 권고| 권고 보기 발견자| Lukasz Rybak 영향을 받는 제품 facturascripts/facturascripts 버전: selectLimit$sql, self::getLimit as $row $result = new static$...
cve-2026-32699-facturascripts-nick-bypass
CVE-2026-32699 - FacturaScripts EditUser Nick パラメータのアクセス制御の欠陥 説明 概要 このアプリケーションは、EditUser コントローラへの POST リクエスト中に nick パラメータを検証できません。UI ではこのフィールドの編集は防止されていますが、ユーザーはプロキシを使用してこの制限をバイパス し、任意のアカウント（管理者を含む） をリネームできます。これにより、アクセス制御の欠陥（Broken Access Control） と、潜在的な監査ログの破損 が発生します。 詳細...
Exploit for CVE-2026-104905
CVE-2026-104905 — PHP Object Injection in FacturaScripts Widg...
CVE-2026-104905
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...
EUVD-2026-92525
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...
CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...
CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...
CVE-2026-104905
FacturaScripts versions prior to 2026.7 are vulnerable to a PHP object injection vulnerability within the WidgetSelect::processFormData() function. The root cause is the application's failure to apply an allowed_classes filter when calling unserialize() on raw POST data for multiple-select fields...
CVE-2026-104905 FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...
PT-2026-106051
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowed classes filter for multiple-select fields. Attackers can submit a serialized XLSXWrite...
CVE-2026-104905: Deserialization of Untrusted Data
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData that allows authenticated attackers to trigger unserialize on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter...
SQL Injection
FacturaScripts is vulnerable to SQL Injection. The vulnerability is due to improper validation and escaping of user-controlled filter field names in sqlColumn, which allows an attacker to inject arbitrary SQL through API filter parameters and retrieve data from arbitrary database tables...
CSV Injection (Formula Injection)
FacturaScripts is vulnerable to CSV Injection Formula Injection. The vulnerability is due to insufficient sanitization of spreadsheet formula prefix characters during CSV export, which allows an attacker to inject malicious formulas that execute when an administrator opens the exported CSV file i...
Cross-site Scripting (XSS)
FacturaScripts is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper encoding of user-controlled referencia and codsubcuenta values in JavaScript within HTML onclick attributes, which allows an attacker to inject and execute arbitrary JavaScript when a user opens the...
GHSA-HGJX-R89M-M7V4 FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE
Summary FacturaScripts\Core\UploadedFile::move$destiny, $destinyName concatenates $destiny and $destinyName without normalizing the resulting path. Every caller in the codebase passes UploadedFile::getClientOriginalName — the unsanitized client-supplied filename — as $destinyName, so an...
