Search
Find a vulnerability
Search criteria
16 vulnerabilities found for file-management-system-php by oretnom23
CVE-2026-114260 (GCVE-0-2026-114260)
Vulnerability from nvd – Published: 2026-10-21 16:45 – Updated: 2026-10-21 16:45 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
Summary
A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424692 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424692/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114260 | third-party-advisory |
| https://vuldb.com/submit/1018612 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"AJAX Handler"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:45:08.221Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424692 | oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424692"
},
{
"name": "VDB-424692 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424692/cti"
},
{
"name": "CVE-2026-114260 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114260"
},
{
"name": "Submit #1018612 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018612"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/8"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114260",
"datePublished": "2026-10-21T16:45:08.221Z",
"dateReserved": "2026-10-21T06:51:20.697Z",
"dateUpdated": "2026-10-21T16:45:08.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114259 (GCVE-0-2026-114259)
Vulnerability from nvd – Published: 2026-10-21 16:30 – Updated: 2026-10-21 16:30 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php admin_class.php save_files unrestricted upload
Summary
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424691 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424691/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114259 | third-party-advisory |
| https://vuldb.com/submit/1018611 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:30:19.549Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424691 | oretnom23 file-management-system-php admin_class.php save_files unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424691"
},
{
"name": "VDB-424691 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424691/cti"
},
{
"name": "CVE-2026-114259 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114259"
},
{
"name": "Submit #1018611 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 Unrestricted Upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018611"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/7"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php admin_class.php save_files unrestricted upload",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114259",
"datePublished": "2026-10-21T16:30:19.549Z",
"dateReserved": "2026-10-21T06:51:16.652Z",
"dateUpdated": "2026-10-21T16:30:19.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114258 (GCVE-0-2026-114258)
Vulnerability from nvd – Published: 2026-10-21 16:15 – Updated: 2026-10-21 16:15 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php File Management files.php sql injection
Summary
A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424690 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424690/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114258 | third-party-advisory |
| https://vuldb.com/submit/1018610 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"File Management"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:15:18.449Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424690 | oretnom23 file-management-system-php File Management files.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424690"
},
{
"name": "VDB-424690 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424690/cti"
},
{
"name": "CVE-2026-114258 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114258"
},
{
"name": "Submit #1018610 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018610"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/6"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php File Management files.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114258",
"datePublished": "2026-10-21T16:15:18.449Z",
"dateReserved": "2026-10-21T06:51:12.758Z",
"dateUpdated": "2026-10-21T16:15:18.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114257 (GCVE-0-2026-114257)
Vulnerability from nvd – Published: 2026-10-21 16:00 – Updated: 2026-10-21 16:00 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php File Download download.php readfile sql injection
Summary
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424689 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424689/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114257 | third-party-advisory |
| https://vuldb.com/submit/1018609 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"File Download"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:00:20.862Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424689 | oretnom23 file-management-system-php File Download download.php readfile sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424689"
},
{
"name": "VDB-424689 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424689/cti"
},
{
"name": "CVE-2026-114257 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114257"
},
{
"name": "Submit #1018609 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018609"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/5"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php File Download download.php readfile sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114257",
"datePublished": "2026-10-21T16:00:20.862Z",
"dateReserved": "2026-10-21T06:51:08.906Z",
"dateUpdated": "2026-10-21T16:00:20.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114256 (GCVE-0-2026-114256)
Vulnerability from nvd – Published: 2026-10-21 15:45 – Updated: 2026-10-21 15:45 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection
Summary
A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424688 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424688/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114256 | third-party-advisory |
| https://vuldb.com/submit/1018608 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"Folder Management"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:45:07.338Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424688 | oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424688"
},
{
"name": "VDB-424688 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424688/cti"
},
{
"name": "CVE-2026-114256 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114256"
},
{
"name": "Submit #1018608 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018608"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114256",
"datePublished": "2026-10-21T15:45:07.338Z",
"dateReserved": "2026-10-21T06:51:04.772Z",
"dateUpdated": "2026-10-21T15:45:07.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114255 (GCVE-0-2026-114255)
Vulnerability from nvd – Published: 2026-10-21 15:30 – Updated: 2026-10-21 15:30 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection
Summary
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424687 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424687/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114255 | third-party-advisory |
| https://vuldb.com/submit/1018607 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"User Account Management"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:30:14.365Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424687 | oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424687"
},
{
"name": "VDB-424687 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424687/cti"
},
{
"name": "CVE-2026-114255 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114255"
},
{
"name": "Submit #1018607 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018607"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114255",
"datePublished": "2026-10-21T15:30:14.365Z",
"dateReserved": "2026-10-21T06:51:00.539Z",
"dateUpdated": "2026-10-21T15:30:14.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114254 (GCVE-0-2026-114254)
Vulnerability from nvd – Published: 2026-10-21 15:15 – Updated: 2026-10-21 15:15 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php admin_class.php login sql injection
Summary
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424686 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424686/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114254 | third-party-advisory |
| https://vuldb.com/submit/1018606 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:15:07.790Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424686 | oretnom23 file-management-system-php admin_class.php login sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424686"
},
{
"name": "VDB-424686 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424686/cti"
},
{
"name": "CVE-2026-114254 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114254"
},
{
"name": "Submit #1018606 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018606"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/2"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php admin_class.php login sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114254",
"datePublished": "2026-10-21T15:15:07.790Z",
"dateReserved": "2026-10-21T06:50:56.471Z",
"dateUpdated": "2026-10-21T15:15:07.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114253 (GCVE-0-2026-114253)
Vulnerability from nvd – Published: 2026-10-21 15:00 – Updated: 2026-10-21 15:00 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php index.php include file inclusion
Summary
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity
CWE
- CWE-73 - File Inclusion
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424685 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424685/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114253 | third-party-advisory |
| https://vuldb.com/submit/1018605 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "File Inclusion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:00:17.099Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424685 | oretnom23 file-management-system-php index.php include file inclusion",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424685"
},
{
"name": "VDB-424685 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424685/cti"
},
{
"name": "CVE-2026-114253 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114253"
},
{
"name": "Submit #1018605 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 File Inclusion",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018605"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php index.php include file inclusion",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114253",
"datePublished": "2026-10-21T15:00:17.099Z",
"dateReserved": "2026-10-21T06:50:52.311Z",
"dateUpdated": "2026-10-21T15:00:17.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114260 (GCVE-0-2026-114260)
Vulnerability from cvelistv5 – Published: 2026-10-21 16:45 – Updated: 2026-10-21 16:45 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
Summary
A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424692 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424692/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114260 | third-party-advisory |
| https://vuldb.com/submit/1018612 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"AJAX Handler"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:45:08.221Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424692 | oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424692"
},
{
"name": "VDB-424692 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424692/cti"
},
{
"name": "CVE-2026-114260 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114260"
},
{
"name": "Submit #1018612 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018612"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/8"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114260",
"datePublished": "2026-10-21T16:45:08.221Z",
"dateReserved": "2026-10-21T06:51:20.697Z",
"dateUpdated": "2026-10-21T16:45:08.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114259 (GCVE-0-2026-114259)
Vulnerability from cvelistv5 – Published: 2026-10-21 16:30 – Updated: 2026-10-21 16:30 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php admin_class.php save_files unrestricted upload
Summary
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424691 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424691/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114259 | third-party-advisory |
| https://vuldb.com/submit/1018611 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:30:19.549Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424691 | oretnom23 file-management-system-php admin_class.php save_files unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424691"
},
{
"name": "VDB-424691 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424691/cti"
},
{
"name": "CVE-2026-114259 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114259"
},
{
"name": "Submit #1018611 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 Unrestricted Upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018611"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/7"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php admin_class.php save_files unrestricted upload",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114259",
"datePublished": "2026-10-21T16:30:19.549Z",
"dateReserved": "2026-10-21T06:51:16.652Z",
"dateUpdated": "2026-10-21T16:30:19.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114258 (GCVE-0-2026-114258)
Vulnerability from cvelistv5 – Published: 2026-10-21 16:15 – Updated: 2026-10-21 16:15 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php File Management files.php sql injection
Summary
A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424690 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424690/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114258 | third-party-advisory |
| https://vuldb.com/submit/1018610 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"File Management"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:15:18.449Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424690 | oretnom23 file-management-system-php File Management files.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424690"
},
{
"name": "VDB-424690 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424690/cti"
},
{
"name": "CVE-2026-114258 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114258"
},
{
"name": "Submit #1018610 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018610"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/6"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php File Management files.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114258",
"datePublished": "2026-10-21T16:15:18.449Z",
"dateReserved": "2026-10-21T06:51:12.758Z",
"dateUpdated": "2026-10-21T16:15:18.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114257 (GCVE-0-2026-114257)
Vulnerability from cvelistv5 – Published: 2026-10-21 16:00 – Updated: 2026-10-21 16:00 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php File Download download.php readfile sql injection
Summary
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424689 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424689/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114257 | third-party-advisory |
| https://vuldb.com/submit/1018609 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"File Download"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:00:20.862Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424689 | oretnom23 file-management-system-php File Download download.php readfile sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424689"
},
{
"name": "VDB-424689 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424689/cti"
},
{
"name": "CVE-2026-114257 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114257"
},
{
"name": "Submit #1018609 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018609"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/5"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php File Download download.php readfile sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114257",
"datePublished": "2026-10-21T16:00:20.862Z",
"dateReserved": "2026-10-21T06:51:08.906Z",
"dateUpdated": "2026-10-21T16:00:20.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114256 (GCVE-0-2026-114256)
Vulnerability from cvelistv5 – Published: 2026-10-21 15:45 – Updated: 2026-10-21 15:45 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection
Summary
A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424688 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424688/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114256 | third-party-advisory |
| https://vuldb.com/submit/1018608 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"Folder Management"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Management. This manipulation of the argument name/parent_id/id/type/folder_id/description causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:45:07.338Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424688 | oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424688"
},
{
"name": "VDB-424688 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424688/cti"
},
{
"name": "CVE-2026-114256 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114256"
},
{
"name": "Submit #1018608 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018608"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114256",
"datePublished": "2026-10-21T15:45:07.338Z",
"dateReserved": "2026-10-21T06:51:04.772Z",
"dateUpdated": "2026-10-21T15:45:07.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114255 (GCVE-0-2026-114255)
Vulnerability from cvelistv5 – Published: 2026-10-21 15:30 – Updated: 2026-10-21 15:30 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection
Summary
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424687 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424687/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114255 | third-party-advisory |
| https://vuldb.com/submit/1018607 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"modules": [
"User Account Management"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:30:14.365Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424687 | oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424687"
},
{
"name": "VDB-424687 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424687/cti"
},
{
"name": "CVE-2026-114255 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114255"
},
{
"name": "Submit #1018607 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018607"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114255",
"datePublished": "2026-10-21T15:30:14.365Z",
"dateReserved": "2026-10-21T06:51:00.539Z",
"dateUpdated": "2026-10-21T15:30:14.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114254 (GCVE-0-2026-114254)
Vulnerability from cvelistv5 – Published: 2026-10-21 15:15 – Updated: 2026-10-21 15:15 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php admin_class.php login sql injection
Summary
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424686 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424686/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114254 | third-party-advisory |
| https://vuldb.com/submit/1018606 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:15:07.790Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424686 | oretnom23 file-management-system-php admin_class.php login sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424686"
},
{
"name": "VDB-424686 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424686/cti"
},
{
"name": "CVE-2026-114254 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114254"
},
{
"name": "Submit #1018606 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018606"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/2"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php admin_class.php login sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114254",
"datePublished": "2026-10-21T15:15:07.790Z",
"dateReserved": "2026-10-21T06:50:56.471Z",
"dateUpdated": "2026-10-21T15:15:07.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114253 (GCVE-0-2026-114253)
Vulnerability from cvelistv5 – Published: 2026-10-21 15:00 – Updated: 2026-10-21 15:00 X_Open Source
VLAI
EPSS
VEX
Title
oretnom23 file-management-system-php index.php include file inclusion
Summary
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity
CWE
- CWE-73 - File Inclusion
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424685 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424685/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114253 | third-party-advisory |
| https://vuldb.com/submit/1018605 | third-party-advisory |
| https://github.com/oretnom23/file-management-syst… | exploitissue-tracking |
| https://github.com/oretnom23/file-management-syst… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oretnom23 | file-management-system-php |
Affected:
2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4
cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*"
],
"product": "file-management-system-php",
"vendor": "oretnom23",
"versions": [
{
"status": "affected",
"version": "2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zeming Hu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "File Inclusion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:00:17.099Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424685 | oretnom23 file-management-system-php index.php include file inclusion",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424685"
},
{
"name": "VDB-424685 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424685/cti"
},
{
"name": "CVE-2026-114253 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114253"
},
{
"name": "Submit #1018605 | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 File Inclusion",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1018605"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/oretnom23/file-management-system-php/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/oretnom23/file-management-system-php/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T09:00:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "oretnom23 file-management-system-php index.php include file inclusion",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114253",
"datePublished": "2026-10-21T15:00:17.099Z",
"dateReserved": "2026-10-21T06:50:52.311Z",
"dateUpdated": "2026-10-21T15:00:17.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}