Description
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-21
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL injection
Action: Mitigate
AI Analysis

Impact

A SQL injection flaw exists in the save_user function of the Project's admin module. Manipulating the name, username, password, type, and id parameters allows an attacker to inject arbitrary SQL statements. An attacker could read, modify, or delete user account data and potentially compromise the database if authenticated privileges are compromised. The weakness is identified as CWE-74 and CWE-89.

Affected Systems

oretnom23 file-management-system-php, versions up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The project follows a rolling release model, so exact newer versions are not listed, but any code built from commits after that may still contain the flaw until a fix is applied.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk. EPSS data is not available, and the vulnerability is not in the CISA KEV catalog. The bug can be exploited remotely by sending crafted HTTP requests to the admin_class.php endpoint. Because public exploit code has been released and the project has not yet provided a patch, the practical risk is elevated over the baseline score.

Generated by OpenCVE AI on October 22, 2026 at 04:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Implement parameterized queries for the save_user function, ensuring that all user-supplied input is correctly escaped and bound to prevent SQL injection.
  • Restrict access to admin_class.php to authenticated and authorized administrators only, employing proper authentication checks and limiting exposure to trusted networks or IP ranges.
  • Continuously monitor oretnom23/file-management-system-php's repository and issue tracker for updates or new commits that address the vulnerability, and upgrade the application as soon as a fix is released.

Generated by OpenCVE AI on October 22, 2026 at 04:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Title oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection
First Time appeared Oretnom23
Oretnom23 file-management-system-php
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:oretnom23:file-management-system-php:*:*:*:*:*:*:*:*
Vendors & Products Oretnom23
Oretnom23 file-management-system-php
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Oretnom23 File-management-system-php
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-28T01:17:10.564Z

Reserved: 2026-10-21T06:51:00.539Z

Link: CVE-2026-114255

cve-icon Vulnrichment

Updated: 2026-10-28T01:17:06.034Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T16:17:32.667

Modified: 2026-10-28T02:17:05.647

Link: CVE-2026-114255

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T04:45:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')