Live › vulnerability › CVE-2026-114257
Go to dashboardThe file download script download.php passes the ID argument into a SQL query without sanitizing it, so a remote attacker can inject SQL. The exploit is public, and the project has not responded to the report.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running the oretnom23 file-management-system-php app (commit 2e3c1ebe or later; no fixed version exists) with download.php reachable. No login is needed: the id GET parameter goes straight into SQL, and a UNION SELECT can set file_path so the server returns any file the web user can read (for example db_connect.php with database credentials) and database contents. Teams not running this app can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| file-management-system-php | other | <= 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 (rolling release) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114257")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.