CVE-2026-114254
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the Login function in admin_class.php. Manipulation of the username/password argument leads to SQL injection. Remote exploitation is possible, and the exploit is publicly available and might be used. The product follows a rolling release approach, so version details are not provided. The project was informed but has not responded yet.
Risk Assessment
The vulnerability could allow an unauthenticated attacker to bypass authentication and gain access to the database, potentially leading to data leakage and application compromise.
Recommendation
Due to the lack of a patch and a public exploit, immediately restrict access to the application, deploy WAF rules to block SQL injection attempts, and consider replacing the vulnerable component.
Other vulnerabilities in file-management-system-php
See all- CVE-2026-114260Medium
In oretnom23 file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the delete_folder function in ajax.php (AJAX Handler component) lacks authentication when the ID argument is manipulated. The vulnerability can be exploited remotely and a public exploit is already available.
- CVE-2026-114259High
In oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the save_files function in admin_class.php allows unrestricted file upload via manipulation of the Upload argument. The exploit has been published and can be launched remotely.
- CVE-2026-114257High
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The readfile function in download.php is affected by manipulation of the ID argument leading to SQL injection; the attack may be performed remotely and a public exploit exists.
- CVE-2026-114256High
A SQL injection vulnerability was identified in file-management-system-php within the save_folder, delete_folder, delete_file, file_rename, and save_files functions of admin_class.php (Folder Management component). Manipulating the name/parent_id/id/type/folder_id/description arguments allows SQL injection. The flaw can be exploited remotely and a public exploit is available.
- CVE-2026-114253Medium
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS