Facturascripts

FacturaScripts is vulnerable to CVE-2026-45263, a CSV formula injection vulnerability due to improper sanitization of user-supplied input when exporting data to CSV files, allowing a low-privilege authenticated user to embed formula-triggering characters in text fields that execute when an administrator opens the exported CSV with spreadsheet software, potentially leading to code execution on the admin's workstation via DDE or macro invocation and credential theft.

An authenticated SQL injection vulnerability exists in the FacturaScripts REST API, specifically in the `filter` parameter of endpoints like `/api/3/clientes` and `/api/3/attachedfiles`. This flaw arises because the `Where::sqlColumn()` function bypasses identifier escaping for strings containing both parentheses, allowing an attacker to inject arbitrary SQL, which enables an attacker with a low-privileged API key to extract sensitive data like admin password hashes and session cookies (`logkey`) from any database table, leading to full account takeover and administrative access.

An authentication bypass vulnerability (CVE-2026-47677) in FacturaScripts' `/login?action=two-factor-validation` endpoint allows unauthenticated attackers to conduct a brute-force attack against Time-based One-Time Passwords (TOTP) for any 2FA-enabled user, including administrators, due to the absence of password verification, CSRF protection, and rate-limiting, leading to complete account takeover with high confidentiality and integrity impact, as well as potential denial of service via account lockout.