CVE-2026-8133

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-8133
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8133.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-8133
Published
2026-05-08T03:30:13.832Z
Modified
2026-08-04T11:51:24.051916152Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
zyx0814 FilePress Shares Filelist API admin.php sql injection
Details

A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of the file dzz/shares/admin.php of the component Shares Filelist API. Such manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is e20ec58414103f781858f2951d178e19b1736664. A patch should be applied to remediate this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-74",
        "CWE-89"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8133.json"
}
References

Affected packages

Git / github.com/zyx0814/filepress

Affected ranges

Type
GIT
Repo
https://github.com/zyx0814/filepress
Events
Introduced
e464a1bdb97fdc38f0fbcbf123ba67c684b92ae6
Last affected
fe72f785054d32269542e04050bf4f73ffc41f14
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        },
        {
            "introduced": "2.1"
        },
        {
            "last_affected": "2.1"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "last_affected": "2.2.0"
        }
    ]
}

Affected versions

2.*
2.0
2.1
2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8133.json"