CVE-2026-114254
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the Login function in admin_class.php. Manipulation of the username/password argument leads to SQL injection. Remote exploitation is possible, and the exploit is publicly available and might be used. The product follows a rolling release approach, so version details are not provided. The project was informed but has not responded yet.
Risk Assessment
The vulnerability could allow an unauthenticated attacker to bypass authentication and gain access to the database, potentially leading to data leakage and application compromise.
Recommendation
Due to the lack of a patch and a public exploit, immediately restrict access to the application, deploy WAF rules to block SQL injection attempts, and consider replacing the vulnerable component.
Other vulnerabilities in file-management-system-php
See all- CVE-2026-114260Medium
In oretnom23 file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the delete_folder function in ajax.php (AJAX Handler component) lacks authentication when the ID argument is manipulated. The vulnerability can be exploited remotely and a public exploit is already available.
- CVE-2026-114257High
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The readfile function in download.php is affected by manipulation of the ID argument leading to SQL injection; the attack may be performed remotely and a public exploit exists.
Original NVD description (English source)
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS