Live › vulnerability › CVE-2026-111619
Go to dashboardFilePress <= 3.0.1 concatenates the unvalidated asc GET parameter into ORDER BY in two file-list handlers; any logged-in library member can run blind boolean/time-based SQL to read other users' and admin credential hashes. No fixed release exists; no known exploitation or public PoC.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running FilePress 3.0.1 or earlier are exposed, and the attacker needs a valid low-privilege user account on the instance. Installations where nobody can register or log in, or where the app is not deployed, can skip it. The sources do not say whether a fixed version exists.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| FilePress | php | <= 3.0.1 | – |
3.0.1 affected; no fixed version exists). 2) In dzz/pichome/library/filelist.php (~line 93) and dzz/collection/filelist.php (~line 56), see if $asc is only trim()'d and not restricted to asc/desc. 3) Grep web logs for mod=pichome&op=library&do=filelist or collection filelist requests with asc values containing select, case, if, sleep, benchmark, ascii, mid. 4) Check whether open registration is on: any registered library member can reach it.3.0.1 is affectedasc/desc (e.g. in dzz/pichome/library/filelist.php and dzz/collection/filelist.php); upgrade once the vendor ships a releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
This page as .md · .json · in your agent: get_signal("CVE-2026-111619")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.