CVE-2026-114254: SQL Injection in oretnom23 file-management-system-php

This vulnerability exists in the oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. It affects the Login function in admin_class.php, where improper sanitization of the username and password arguments allows an attacker to perform SQL injection. The vulnerability is remotely exploitable without authentication. The project follows a rolling release approach, so no discrete version numbers are given for affected or patched releases. The issue was reported early, but no vendor response or patch has been provided as of the publication date. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the Login function. This may lead to unauthorized data access, data modification, or other database impacts depending on the database privileges of the application. The vulnerability is remotely exploitable without authentication, increasing the attack surface. However, no active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing temporary mitigations such as input validation or web application firewall rules to block malicious SQL injection payloads targeting the Login function. Monitor official project channels for updates and apply patches promptly once available.