CVE-2026-111619: high-severity vulnerability in zyx0814 FilePress
FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.3%
exploitation probability
0.3%top 74% of all CVEs
observed exploitation
nono source reports it
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
zyx0814 · FilePressRelated CVEs — zyx0814 FilePress
In the same product, most dangerous first.
References
https://github.com/zyx0814/FilePresshttps://github.com/zyx0814/FilePress/blob/3.0.1/dzz/collection/filelist.php#L453-L496https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L594-L642https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L93https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-orderby-sqlihttps://www.vulncheck.com/advisories/filepress-through-3.0.1-sql-injection-via-asc-parameter-in-filelist-php