Live › vulnerability › CVE-2026-114256
Go to dashboardThe file-management-system-php project has SQL injection in its folder and file management functions in admin_class.php, reachable through the name, parent_id, id, type, folder_id and description arguments. A remote attacker can read or change the application's database, and the exploit is public.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any deployment of oretnom23 file-management-system-php at or before commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 is exposed, since the flawed functions take user-supplied input directly into SQL queries. Systems that do not run this project can skip it. Whether a login is needed to reach the vulnerable functions is not stated in the sources.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114256")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.