Is CVE-2026-45262 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45262 being exploited in the wild.

How severe is CVE-2026-45262?

Critical severity, with a CVSS score of 9.9, published 14 July 2026.

Which products and versions are affected?

NeoRazorX FacturaScripts <= 2026.1; facturascripts/facturascripts (Packagist) <= 2026.1, ECOSYSTEM:introduced=0,last_affected=2026.1.

Is there a fix for CVE-2026-45262?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45262 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45262?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45262: FacturaScripts SQL injection in REST API filter parameter

Q: Is there a fix for CVE-2026-45262?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-45262 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-45262?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45262 · Severity: critical · CVSS 9.9 · Published 2026-07-14

FacturaScripts is an open-source ERP and accounting system. A security vulnerability in its API allows an attacker with limited access to bypass security filters and run unauthorized database commands. This can lead to the theft of administrator passwords, full account takeover, and the ability to modify or delete sensitive financial and customer data.

Technologies: NeoRazorX FacturaScripts, facturascripts/facturascripts (Packagist). Vendors: NeoRazorX, Packagist.

Quick answers

Is CVE-2026-45262 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45262 being exploited in the wild.
How severe is CVE-2026-45262?: Critical severity, with a CVSS score of 9.9, published 14 July 2026.
Which products and versions are affected?: NeoRazorX FacturaScripts <= 2026.1; facturascripts/facturascripts (Packagist) <= 2026.1, ECOSYSTEM:introduced=0,last_affected=2026.1.
Is there a fix for CVE-2026-45262?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45262 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45262?: Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated SQL injection vulnerability exists in FacturaScripts versions up to 2026.1. The root cause is located in `Core/Where.php::sqlColumn()`, which fails to escape database identifiers if they contain both '(' and ')' characters. This logic was intended to support SQL expressions but lacks structural validation. Attackers can exploit this by providing a malicious SQL payload within the `filter` parameter of the REST API (e.g., `/api/3/clientes`). Because the API filter keys are not validated against an allow-list, the payload is concatenated directly into the WHERE clause. This allows for UNION-based or time-based blind SQL injection, enabling the extraction of sensitive data like bcrypt hashes and session 'logkeys' from the users table, leading to full administrative takeover.

Affected products

NeoRazorX FacturaScripts <= 2026.1

Identifiers

CVE-2026-45262
GHSA-5qmh-x653-g8qj

Timeline

2026-04-30: other: Vulnerability verified via PoC
2026-07-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.