CVE-2026-8133: SQL Injection in zyx0814 FilePress
CVE-2026-8133 is a medium severity SQL injection vulnerability in zyx0814 FilePress versions up to 2.2.0. It affects an unknown functionality in the file dzz/shares/admin.php within the Shares Filelist API component. The vulnerability arises from manipulation of the argument 'order', allowing remote attackers to perform SQL injection. A patch identified by the hash e20ec58414103f781858f2951d178e19b1736664 has been released to address this issue. No known exploits are reported in the wild at this time.
AI Analysis
Technical Summary
This vulnerability in zyx0814 FilePress (up to version 2.2.0) allows remote attackers to exploit an SQL injection flaw via manipulation of the 'order' argument in the Shares Filelist API component located in dzz/shares/admin.php. The injection can lead to unauthorized database queries. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. A patch is available and should be applied to remediate the issue.
Potential Impact
Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. No known active exploitation has been reported.
Mitigation Recommendations
A patch identified by commit e20ec58414103f781858f2951d178e19b1736664 is available and should be applied promptly to remediate this vulnerability. Since the vendor advisory or official remediation details are not provided, users should verify and apply the patch from the vendor's official source. No alternative mitigations or workarounds are indicated.
CVE-2026-8133: SQL Injection in zyx0814 FilePress
Description
CVE-2026-8133 is a medium severity SQL injection vulnerability in zyx0814 FilePress versions up to 2.2.0. It affects an unknown functionality in the file dzz/shares/admin.php within the Shares Filelist API component. The vulnerability arises from manipulation of the argument 'order', allowing remote attackers to perform SQL injection. A patch identified by the hash e20ec58414103f781858f2951d178e19b1736664 has been released to address this issue. No known exploits are reported in the wild at this time.
CVSS v4.0
Score 6.9medium
Affected software
pkg:github/zyx0814/FilePressRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in zyx0814 FilePress (up to version 2.2.0) allows remote attackers to exploit an SQL injection flaw via manipulation of the 'order' argument in the Shares Filelist API component located in dzz/shares/admin.php. The injection can lead to unauthorized database queries. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. A patch is available and should be applied to remediate the issue.
Potential Impact
Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. No known active exploitation has been reported.
Mitigation Recommendations
A patch identified by commit e20ec58414103f781858f2951d178e19b1736664 is available and should be applied promptly to remediate this vulnerability. Since the vendor advisory or official remediation details are not provided, users should verify and apply the patch from the vendor's official source. No alternative mitigations or workarounds are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-07T17:33:03.678Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fd5dc1cbff5d86108b64bf
Added to database: 05/08/2026, 03:51:29 UTC
Last enriched: 05/15/2026, 11:00:08 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 122
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.