CVE-2026-114255: SQL Injection in oretnom23 file-management-system-php

This vulnerability in oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 allows remote attackers to execute SQL injection attacks via manipulation of the name, username, password, type, or id parameters in the save_user function of admin_class.php. The flaw impacts the User Account Management component and can be exploited without authentication. The rolling release nature of the product means no fixed version information is available. The vendor has not responded to the issue report, and public exploit code has been released.

Successful exploitation of this vulnerability can allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. Given the affected component manages user accounts, this could compromise user data and system integrity. The availability of public exploit code increases the likelihood of attacks.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's project for updates or patches. Until a fix is released, consider restricting access to the affected functionality or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the save_user function parameters.