zyx0814 CVE debriefs

CVE-2026-111619

FilePress through 3.0.1 contains an SQL injection vulnerability via the asc parameter in filelist.php, allowing authenticated low-privilege users to inject SQL into ORDER BY clauses. This could potentially allow attackers to extract database rows, including administrator credential hashes. The vulnerability is particularly concerning in environments where low-privilege user accounts exist, as it could lea [truncated]