Threat database

FilePress versions up to 3.0.1 contain an SQL injection vulnerability that allows authenticated low-privilege users to inject SQL code via the 'asc' parameter in ORDER BY clauses. This vulnerability affects specific PHP scripts and can be exploited using blind boolean or time-based subqueries to extract sensitive database information, including administrator credential hashes.

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-8133 is a medium severity SQL injection vulnerability in zyx0814 FilePress versions up to 2.2.0. It affects an unknown functionality in the file dzz/shares/admin.php within the Shares Filelist API component. The vulnerability arises from manipulation of the argument 'order', allowing remote attackers to perform SQL injection. A patch identified by the hash e20ec58414103f781858f2951d178e19b1736664 has been released to address this issue. No known exploits are reported in the wild at this time.