SQL Injection Vulnerability in FilePress by ZYX Technology

CVE-2026-111619

What is CVE-2026-111619?

FilePress, up to version 3.0.1, is susceptible to an SQL injection vulnerability that allows authenticated low-privilege users to potentially manipulate ORDER BY clauses via the unvalidated 'asc' parameter. This weakness can be exploited through blind boolean or time-based subqueries present in the filelist.php scripts. By leveraging this vulnerability, attackers may access sensitive database information, including hashes of administrator credentials, posing a significant risk to the application’s security.

References