https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-25514.htmlhttps://patchthecve.com/cve/CVE-2026-25514.htmlWed, 17 Jun 2026 10:24:46 +0000HIGH 8.8: FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensitive data from the database including usehttps://patchthecve.com/cve/CVE-2026-25513.htmlhttps://patchthecve.com/cve/CVE-2026-25513.htmlWed, 17 Jun 2026 10:24:46 +0000HIGH 8.8: FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries through the sort parameter. The vulnerabilhttps://patchthecve.com/cve/CVE-2026-23997.htmlhttps://patchthecve.com/cve/CVE-2026-23997.htmlWed, 17 Jun 2026 10:22:27 +0000HIGH 8.0: FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity enhttps://patchthecve.com/cve/CVE-2026-23476.htmlhttps://patchthecve.com/cve/CVE-2026-23476.htmlWed, 17 Jun 2026 10:21:39 +0000MEDIUM 5.4: FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected XSS bug in FacturaScripts. The problem is in how error messages get displayed. Twig's | raw filter is used, which skips HTML escaping. When triggering a database error (like passinghttps://patchthecve.com/cve/CVE-2025-69210.htmlhttps://patchthecve.com/cve/CVE-2025-69210.htmlWed, 17 Jun 2026 10:00:17 +0000MEDIUM 5.4: FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files containing executable JavaScript. These fil