CVE-2026-114254 oretnom23 CVE debrief

Who should care

Defenders responsible for oretnom23 file-management-system-php deployments should assess exposure and prioritize remediation, as the exploit is publicly available and remote exploitation is possible. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the vulnerability in their inventory and prioritize remediation efforts.

Why it matters

Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure, as the exploit is publicly available and remote exploitation is possible.

• Verify vulnerability in inventory and assess exposure
• Prioritize remediation due to publicly available exploit
• Monitor for potential exploitation attempts

Technical summary

The vulnerability affects the Login function in admin_class.php of oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The manipulation of the username and password arguments leads to SQL injection. Remote exploitation of the attack is possible. The project follows a rolling release approach, so version details for affected or updated releases are not provided. This vulnerability has a CVSS score of 6.9 and a MEDIUM severity. Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure.

Defensive priority

Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure, as the exploit is publicly available.

Recommended defensive actions

• Verify the vulnerability in inventory
• Assess exposure and prioritize remediation
• Monitor for potential exploitation attempts
• Apply vendor patch if available
• Implement compensating controls for exposed systems
• Review asset inventory for affected product deployments
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability, but version information for affected or updated releases is not provided due to the rolling release approach. The exploit is publicly available, and remote exploitation is possible. Defenders should verify the vulnerability in their inventory and assess exposure. The vulnerability affects the Login function in admin_class.php of oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.