CVE-2026-111619: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in zyx0814 FilePress

CVE-2026-111619 describes an SQL injection vulnerability in FilePress through version 3.0.1. Authenticated low-privilege users can exploit improper neutralization of special elements in the asc parameter used in ORDER BY clauses within dzz/pichome/library/filelist.php and dzz/collection/filelist.php. This enables blind boolean or time-based SQL injection attacks to extract database rows, including administrator credential hashes. The vulnerability is confirmed with a CVSS 4.0 score of 7.1, indicating high severity.

Exploitation allows low-privilege authenticated users to perform SQL injection attacks, potentially exposing sensitive database information such as administrator credential hashes. This could lead to unauthorized data disclosure and compromise of administrative accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, restrict access to authenticated users and monitor for suspicious activity related to the vulnerable parameters.