CVE-2026-111619: falha de alta gravidade em zyx0814 FilePress
FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
probabilidade de exploração
0.3%top 74% das CVEs
exploração observada
nãonenhuma fonte reporta
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
zyx0814 · FilePressCVEs relacionadas — zyx0814 FilePress
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/zyx0814/FilePresshttps://github.com/zyx0814/FilePress/blob/3.0.1/dzz/collection/filelist.php#L453-L496https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L594-L642https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L93https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-orderby-sqlihttps://www.vulncheck.com/advisories/filepress-through-3.0.1-sql-injection-via-asc-parameter-in-filelist-php