One Email Leaks the DB Password, One GET Takes the ERP Down
Two FacturaScripts advisories, same product, same day. A path traversal in the mail attachment handler emails config.php to an attacker (CVSS 9.9). A Deploy endpoint signed with md5 of the database password lets anyone disable every plugin (CVSS 7.5). The first bug hands you the key to the second.