CVE-2026-114255 oretnom23 CVE debrief

Who should care

Defenders responsible for PHP-based user account management systems, especially those using oretnom23 file-management-system-php, should assess exposure and prioritize verification of their inventory.

Why it matters

CVE-2026-114255 is a SQL injection vulnerability in oretnom23 file-management-system-php that can be exploited remotely. Defenders should verify exposure, assess attack feasibility, and prioritize monitoring and compensating controls.

• Verify exposure in PHP-based user account management systems
• Assess feasibility of remote SQL injection attacks
• Monitor system logs for potential SQL injection attempts
• Consider compensating controls like web application firewalls

Technical summary

The vulnerability is located in the save_user function of the admin_class.php file in the User Account Management component of oretnom23 file-management-system-php. The manipulation of the name, username, password, type, and id arguments can result in SQL injection. The attack can be executed remotely, and the exploit has been released to the public. This SQL injection vulnerability in oretnom23 file-management-system-php can be exploited remotely, allowing attackers to manipulate the database. Defenders should verify exposure, assess attack feasibility, and prioritize monitoring and compensating controls.

Defensive priority

Defenders should prioritize verifying exposure in their inventory of PHP-based user account management systems, especially those using oretnom23 file-management-system-php, and assess the feasibility of remote SQL injection attacks.

Recommended defensive actions

• Verify inventory of PHP-based user account management systems using oretnom23 file-management-system-php
• Assess the feasibility of remote SQL injection attacks on the system
• Monitor system logs for potential SQL injection attempts
• Consider implementing compensating controls, such as web application firewalls
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected component. However, the exact versions affected are unknown due to the rolling release model of the product.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.