Live › vulnerability › CVE-2026-114258
Go to dashboardThe oretnom23 file-management-system-php project has an SQL injection flaw in files.php, where the fid or id argument is passed into database queries unsafely. A remote attacker can read or change database contents, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that deploy the oretnom23 file-management-system-php application with files.php reachable from the network are exposed, since the flaw is triggered through the fid or id argument. Teams that do not run this project, or that only use it on a closed internal network with no remote access, can skip it.
No product ranges from the sources yet.
file-management-system-php from oretnom23 by looking for files.php under a File Management component in the deployed codebase2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4, which the sources list as the last affected versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114258")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.