EUVD-2026-28522
GHSA-pxqj-577f-7xfv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of the file dzz/shares/admin.php of the component Shares Filelist API. Such manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is e20ec58414103f781858f2951d178e19b1736664. A patch should be applied to remediate this issue.
AnalysisAI
SQL injection in FilePress up to version 2.2.0 allows unauthenticated remote attackers to manipulate the order parameter in the Shares Filelist API (dzz/shares/admin.php and dzz/shares/ajax.php) to execute arbitrary SQL queries. The vulnerability exploits insufficient input validation on the order parameter, enabling data exfiltration or manipulation. Publicly available exploit code exists, and a vendor patch has been released.
Technical ContextAI
FilePress is a PHP-based file-sharing application. The vulnerability exists in the Shares Filelist API components (dzz/shares/admin.php and dzz/shares/ajax.php), where user-supplied input from the GET parameter 'order' is passed directly into SQL queries without proper validation. The root cause (CWE-89: SQL Injection) stems from accepting unsanitized user input that controls SQL ORDER BY clause construction. The patch implements a whitelist approach by converting the order parameter to lowercase, then validating it against an explicit array of permitted values ('asc' and 'desc'), replacing the previous approach that only used trim() without validation. This is a classic SQL injection vector where an attacker manipulates query syntax by injecting SQL commands through a parameter intended for legitimate sorting operations.
RemediationAI
Apply the vendor-released patch immediately by upgrading to the version containing commit e20ec58414103f781858f2951d178e19b1736664 or later (patch PR #71 at https://github.com/zyx0814/FilePress/pull/71). The patch implements input validation by converting the order parameter to lowercase and enforcing a whitelist of permitted values ('asc', 'desc'). If an immediate upgrade is not feasible, implement network-level compensating controls: restrict access to the dzz/shares/admin.php and dzz/shares/ajax.php endpoints to trusted IP ranges only (e.g., via reverse proxy rules), disable the Shares API feature if not actively used, or deploy a Web Application Firewall (WAF) rule to block requests with suspicious order parameter values (e.g., containing SQL keywords like UNION, SELECT, CASE). Note that WAF rules may generate false positives if legitimate sorting operations use unexpected case variations; prioritize the vendor patch over WAF mitigation. Monitor web server logs for exploitation attempts targeting the Shares API endpoints.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today