This vulnerability resides in the Login function of the admin_class.php file of oretnom23 File‑Management‑System‑PHP. By manipulating the username and password fields an attacker can inject arbitrary SQL statements against the underlying database. The injection could allow the attacker to read, modify, or delete data.

Affected systems are deployments of oretnom23 File‑Management‑System‑PHP whose codebase has not yet migrated beyond the commit hash 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The product follows a rolling‑release model, so version identifiers are not explicitly tied to the vulnerability but any release dated before the fix remains vulnerable.

The CVSS score of 6.9 indicates a medium‑high severity. The EPSS score is unavailable, but the vulnerability is publicly known to be exploitable and an exploit is publicly available. It is not included in the CISA KEV catalog. The attack surface is remote and does not require privileged access, making it attractive for attackers seeking data compromise.