Threats affecting pkg:github/zyx0814/FilePress

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-8133 is a medium severity SQL injection vulnerability in zyx0814 FilePress versions up to 2.2.0. It affects an unknown functionality in the file dzz/shares/admin.php within the Shares Filelist API component. The vulnerability arises from manipulation of the argument 'order', allowing remote attackers to perform SQL injection. A patch identified by the hash e20ec58414103f781858f2951d178e19b1736664 has been released to address this issue. No known exploits are reported in the wild at this time.