file-management-system-php CVE-2026-114254

No special conditions beyond network reachability of the application's admin login page - exploitation targets the default authentication flow (the Login function in admin_class.php) via the username/password parameters, requiring no prior authentication or user interaction (PR:N/UI:N). The practical limiting factors are: the attacker must be able to reach the admin login interface over the network, and because this is a rolling-release project with no versioning, defenders cannot pin an affected-vs-fixed boundary - the product is only deployed up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 as referenced, and no patched build exists.

This is a pre-authentication SQL injection (CWE-89) in the Login function of admin_class.php, reachable remotely with no privileges or user interaction (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N). On attack-surface grounds it is a genuinely dangerous class of flaw - an unauthenticated login-form SQLi commonly enables authentication bypass and database extraction. However, the real-world priority is tempered by several signals that pull in the opposite direction: the CVSS 4.0 base score is only 6.9 (Medium) because the vendor-supplied impact metrics are all Low (VC:L/VI:L/VA:L), the exploit maturity is only 'E:P' (Proof-of-Concept, not actively weaponized), the issue is NOT on the CISA KEV list, and no EPSS score was supplied in the input. The sole exploit reference is a GitHub issue report, and the project 'has not responded yet,' meaning there is no patch. Signals are therefore consistent rather than conflicting: a real but low-impact-rated, POC-stage vulnerability in a niche product. Note one caveat to verify: SQL injection in a login handler often warrants higher confidentiality impact than the Low rating assigned here, so the vendor's VC:L may understate data-exposure risk - treat the Low impacts as a lower bound.

A remote, unauthenticated attacker submits a crafted username or password value to the admin login endpoint, injecting SQL that is concatenated into the authentication query in admin_class.php. This can allow authentication bypass or extraction of credential and file-metadata records from the backing database. Publicly available proof-of-concept detail exists in the project's GitHub issue tracker, lowering the barrier to reproduction.