This vulnerability affects zyx0814 FilePress up to version 2.2.0 in the Shares Filelist API component, specifically in the dzz/shares/admin.php file. The issue arises from improper handling of the argument order, which can be exploited remotely to perform SQL injection attacks. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. A patch has been made available under the identifier e20ec58414103f781858f2951d178e19b1736664 to remediate the vulnerability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database through the Shares Filelist API. This may lead to unauthorized data access or modification. However, the impact is rated as low for confidentiality, integrity, and availability, and no known active exploitation has been reported.

A patch identified by the hash e20ec58414103f781858f2951d178e19b1736664 is available and should be applied to all affected versions (2.0, 2.1, and 2.2.0) of zyx0814 FilePress to remediate this SQL injection vulnerability. No additional vendor advisory details are provided, so users should verify patch availability and installation instructions from the official vendor channels.