Live › vulnerability › CVE-2026-114255
Go to dashboardThe save_user function in admin_class.php of the User Account Management component fails to sanitize the name, username, password, type and id parameters, allowing SQL injection. A remote attacker can read or change database contents, and the exploit is public.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 that expose the User Account Management pages are exposed. Teams that do not run this project, or run a later version that has changed this code, are not affected; the sources do not confirm which later versions are safe.
No product ranges from the sources yet.
admin_class.php and confirming save_user builds SQL from request parametersEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114255")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.