CVE-2026-77526: FacturaScripts Path Traversal Vulnerability Leads to Arbitrary File Write and RCE. The vulnerability exists in the `UploadedFile::move()` method of FacturaScripts, allowing an authenticated user to write uploaded content to any directory writable by the web-server user, potentially leading to remote code execution. This issue arises from the method's failure to normalize the resulting path [truncated]
Authenticated SQL injection vulnerability in FacturaScripts REST API filter parameter allows for end-to-end account takeover with a read-only token. The vulnerability exists due to improper handling of user input in the filter parameter, specifically in the `Core/Where.php::sqlColumn()` function, which exempts field names containing both `(` and `)` from identifier escaping. This allows an attacker to inj [truncated]
