CVE-2026-90879

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-90879

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90879.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-90879

Published

2026-09-15T04:30:09Z

Modified

2026-09-17T03:30:17Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

zyx0814 FilePress Publish search.php sql injection

Details

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-74",
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90879.json"
}

References

Affected packages

Git / github.com/zyx0814/filepress

Affected ranges

Type

GIT

Repo

https://github.com/zyx0814/filepress

Events

Introduced

bf2a042b04393e4f59ef6c7eb229bfacf48a19d9

Last Affected

244975d99b99c0308224726010dd9253dc39bddb

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "3.0.1"
        },
        {
            "last_affected": "3.0.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

3.*

3.0.0

3.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90879.json"