The flaw discovered in zyx0814 FilePress allows a remote attacker to manipulate the order of arguments in the Shares Filelist API admin.php, which in turn triggers SQL injection. This weakness is classified under CWE‑74 and CWE‑89 and permits execution of arbitrary SQL statements against the database, leading to potential leakage or alteration of sensitive data and disruption of application functionality.

All releases of zyx0814 FilePress containing the Shares Filelist API up to version 2.2.0 are affected. No earlier or later versions are noted as vulnerable in the available data.

The CVSS score of 6.9 indicates medium severity. No EPSS score is available, so the current likelihood of exploitation remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, meaning that any client able to reach the API endpoint can potentially exploit the flaw without needing authentication. An exploit has been publicly disclosed, suggesting that exploitation is feasible if the patch is not applied.