oretnom23 file-management-system-php: SQL injection in Login function (CVE-2026-114254)
A SQL injection vulnerability exists in the Login function of admin_class.php in oretnom23 file-management-system-php, caused by the manipulation of the username or password arguments.
CVE search metadata
CVE search record: CVE-2026-114254. Severity: high. CVSS: 7.3. KEV: no. Product: oretnom23 file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4). Brief: oretnom23 file-management-system-php: SQL injection in Login function (CVE-2026-114254). Brief link: https://feed.craftedsignal.io/briefs/2026-10-file-management-system-sqli/
CVE search record: CVE-2026-114255. KEV: no. Product: oretnom23 file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4). Brief: oretnom23 file-management-system-php: SQL injection in Login function (CVE-2026-114254). Brief link: https://feed.craftedsignal.io/briefs/2026-10-file-management-system-sqli/
Triage facts
Revision 1- Applicability
- oretnom23 file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 21, 17:08 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Roughly even chance
What's new
- 1. added coverage for file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4) Oct 21, 19:16 via nvd
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The Login function of admin_class.php is susceptible to SQL injection via the manipulation of the username or password arguments. Remote exploitation is possible, and a public exploit exists. The project maintainer has been informed but has not yet responded.