HIGH 7.1 NVD
CVE-2026-111619
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvali
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
References
- https://github.com/zyx0814/FilePress
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/collection/filelist.php#L453-L496
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L594-L642
- https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L93
- https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-orderby-sqli
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-16 via NVD.
vulnfeed aggregates 16467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.