CVE-2026-114257

The oretnom23 file-management-system-php is vulnerable to SQL injection in the File Download component, specifically within the readfile function of the download.php file. The vulnerability is triggered by the manipulation of the ID argument and can be exploited remotely. While the exploit has be...

EUVD-2026-107336

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...

CVE-2026-114257 oretnom23 file-management-system-php File Download download.php readfile sql injection

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...

CVE-2026-114257 oretnom23 file-management-system-php File Download download.php readfile sql injection

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...

Mem0 SQL injection vulnerability

Versions prior to Mem0 1.0.8, specifically version 0.1.117, contain an SQL injection vulnerability. This flaw stems from unescaped string interpolation within insert and update functions in Mem0/vectorstores/databricks.py. Attackers can exploit this by providing specially crafted memory text,...

Lotus SQL injection vulnerability

Lotus 0.10.2 and earlier versions contain an SQL injection vulnerability. This vulnerability arises because only keyword validation is performed on registered subscriptionfilterkeys. Attackers can exploit this value as an unquoted group-by identifier, injecting SQL code into usage aggregation...

Frappe SQL injection vulnerability

Frappe has an SQL injection vulnerability. This vulnerability arises because the frappe.desk.doctype.event.event.getevents method fails to properly sanitize user inputs before incorporating them into SQL queries. As a result, blind SQL injection is possible. Authenticated attackers can send...

Lotus SQL injection vulnerability

Lotus 0.10.2 and earlier versions contain an SQL injection vulnerability. This vulnerability arises from the addition of stacked statements to custom metric queries. Attackers can submit SQL statements separated by semicolons via POST /app/metrics/, bypassing only the first statement validation...

Drupal amazee.ai Private AI Provider SQL injection vulnerability

Drupal amazee.ai Private AI Provider versions prior to 0.0.0 and 1.3.7, as well as versions prior to 1.4.0 and 1.4.3, contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

AmentoTech Workreap Core SQL injection vulnerability

Versions of AmentoTech Workreap Core prior to 3.4.4 contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to blind SQL injection...

SeaCMS SQL injection vulnerability

SeaCMS versions 8.7 and earlier contain an SQL injection vulnerability. This vulnerability stems from unauthenticated SQL injection; attackers can inject SQL code via the rlist array parameter in /comment/api/index.php, then use error messages to extract database information...

Drupal CSP log SQL injection vulnerability

Drupal CSP versions prior to 1.0.2 contain an SQL injection vulnerability. This vulnerability arises from improper neutralization of special elements within SQL commands, potentially leading to SQL injection attacks...

Lotus SQL injection vulnerability

Lotus 0.10.2 and earlier versions contain an SQL injection vulnerability. This vulnerability arises because the billable metric propertyname and category filter values are rendered directly into Jinja-generated queries for counting, dashboards, and rate metrics without proper escaping. As a resul...

Exploit for CVE-2026-52887

nocobase-cve-2026-52887 NocoBase security research and exploi...

CVE-2026-114256 oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function savefolder/deletefolder/deletefile/filerename/savefiles of the file adminclass.php of the component Folder Management. This manipulation of the argument...

CVE-2026-114256

A SQL injection vulnerability exists in the Folder Management component of oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4). The flaw is located in the admin_class.php file and affects the save_folder , delete_folder , delete_file , file_rename , and sa...

CVE-2026-114256 oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function savefolder/deletefolder/deletefile/filerename/savefiles of the file adminclass.php of the component Folder Management. This manipulation of the argument...

EUVD-2026-107332

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function savefolder/deletefolder/deletefile/filerename/savefiles of the file adminclass.php of the component Folder Management. This manipulation of the argument...

CVE-2026-114255 oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection

A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function saveuser of the file adminclass.php of the component User Account Management. The manipulation of the argument name/username/password/type/id resul...

CVE-2026-114255

A security flaw exists in the User Account Management component of oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4). The vulnerability is located in the save_user function within the admin_class.php file, where improper handling of the name/username/pas...