Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-104905 Details

Description

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-p89j-gj6f-fh6g	CISA-ADP
https://github.com/NeoRazorX/facturascripts/releases/tag/v2026.7	[email protected]
https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-p89j-gj6f-fh6g	[email protected]
https://www.vulncheck.com/advisories/facturascripts-php-object-injection-via-widgetselect	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-502	Deserialization of Untrusted Data	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 5, 2026	CVE Modified	CISA-ADP
Oct 5, 2026	New CVE Received	[email protected]