CVE-2026-90879

18th percentile - higher than 18% of all known CVEs

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to SQL injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

The vulnerability allows a remote attacker to inject arbitrary SQL queries, potentially leading to data leakage or modification. The risk is high because the exploit is publicly available and the project has not responded to the report.

Due to the lack of response from the project, it is recommended to discontinue use of FilePress or implement custom fixes to filter the orderby/order parameters. Monitor access to search.php and restrict access to the application.