Live › vulnerability › CVE-2026-114254
Go to dashboardThe Login function in admin_class.php of oretnom23 file-management-system-php does not sanitize the username and password fields before using them in SQL queries. A remote attacker can inject SQL to read or modify the application's database, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any deployment of oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 that exposes its login form to the network is exposed. The sources do not name a patched version and the project has not responded to the report, so teams running this code should restrict access or replace the login logic.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| file-management-system-php | github | <= commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 | – |
$username and password = $password by string concatenation, it is vulnerablecurl -s -d "username=nobody&password=wrong" $BASE/ajax.php?action=login returns 2or1'='1' limit 1 -- - and if it returns 1, you are exposedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114254")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.