--- title: "CVE-2026-114254: oretnom23 file-management-system-php - SQL Injection" description: "oretnom23 file-management-system-php contains a SQL injection caused by manipulation of username/password arguments in admin_class.php Login function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input." url: https://panop.io/threat-heartbeat/CVE-2026-114254/ --- # CVE-2026-114254 oretnom23 file-management-system-php - SQL Injection oretnom23 file-management-system-php contains a SQL injection caused by manipulation of username/password arguments in admin\_class.php Login function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input. CVSS base score 7.3 /10 High CISA KEV Not listed Public exploit None known Authentication Not required [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-114254) ## Details Type SQL Injection Impact SQL Injection CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Published 21 October 2026 Updated 22 October 2026 Weakness [CWE-74](https://cwe.mitre.org/data/definitions/74.html) ## Vendor fix Update to the latest version of oretnom23 file-management-system-php. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-114254](https://nvd.nist.gov/vuln/detail/CVE-2026-114254) - [https://github.com/oretnom23/file-management-system-php/](https://github.com/oretnom23/file-management-system-php/) - [https://github.com/oretnom23/file-management-system-php/issues/2](https://github.com/oretnom23/file-management-system-php/issues/2) - [https://vuldb.com/cve/CVE-2026-114254](https://vuldb.com/cve/CVE-2026-114254) - [https://vuldb.com/submit/1018606](https://vuldb.com/submit/1018606) - [https://vuldb.com/vuln/424686](https://vuldb.com/vuln/424686) - [https://vuldb.com/vuln/424686/cti](https://vuldb.com/vuln/424686/cti) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)