Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

Fix availableCritical · CVSS 9.9

Published Jul 14, 2026 · updated Nov 2, 2026

What to do

  1. Upgrade to a fixed version: facturascripts/facturascripts 2026.2.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Composerfacturascripts/facturascripts

Vulnerable versions
<= 2026.1
Fixed in
2026.2

Check your project: composer show facturascripts/facturascripts

Sources

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') · CWE-918 Server-Side Request Forgery (SSRF)

← All critical vulnerabilities