Vulnerabilities ›

CVE-2026-8133

High

CWE-74 — Weakness Type

                    Published: May 8, 2026                      ·  Modified: May 15, 2026                      ·  Source: NVD                

CVSS v3

7.3

🔗 NVD Official

📄 Description (English)

A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of the file dzz/shares/admin.php of the component Shares Filelist API. Such manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is e20ec58414103f781858f2951d178e19b1736664. A patch should be applied to remediate this issue.

🤖 AI Executive Summary

A SQL injection vulnerability exists in zyx0814 FilePress up to version 2.2.0 in the Shares Filelist API component that allows remote attackers to manipulate argument order and execute arbitrary SQL queries. The vulnerability has been publicly disclosed and patches are available.

📄 Description (Arabic)

ثغرة حقن SQL في ملف dzz/shares/admin.php من مكون Shares Filelist API في zyx0814 FilePress تسمح بمعالجة ترتيب المعاملات لتنفيذ استعلامات SQL عشوائية. يمكن استغلال هذه الثغرة عن بعد وقد تم الكشف عن طرق الاستغلال علناً.

🤖 ملخص تنفيذي (AI)

ثغرة حقن SQL موجودة في zyx0814 FilePress حتى الإصدار 2.2.0 في مكون Shares Filelist API تسمح للمهاجمين البعيدين بمعالجة ترتيب الحجج وتنفيذ استعلامات SQL عشوائية. تم الكشف عن الثغرة علنًا وتتوفر التصحيحات.

🤖 AI Intelligence Analysis Analyzed: May 12, 2026 15:03

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

banking government healthcare

🎯 MITRE ATT&CK Techniques

T1190 T1083 T1005

⚖️ Saudi Risk Score (AI)

7.0

/ 10.0

🔧 Remediation Steps (English)

Update zyx0814 FilePress to version 2.2.1 or later immediately. Apply patch e20ec58414103f781858f2951d178e19b1736664. Implement input validation and parameterized queries for all database operations. Restrict access to admin.php to authorized users only. Monitor database logs for suspicious SQL activity.

🔧 خطوات المعالجة (العربية)

قم بتحديث zyx0814 FilePress إلى الإصدار 2.2.1 أو أحدث فوراً. طبق التصحيح e20ec58414103f781858f2951d178e19b1736664. طبق التحقق من صحة الإدخال والاستعلامات المعاملة لجميع عمليات قاعدة البيانات. قيد الوصول إلى admin.php للمستخدمين المصرح لهم فقط. راقب سجلات قاعدة البيانات للنشاط المريب.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

A.1.1.1 A.2.1.1 A.2.2.1

🔵 SAMA CSF

ID.RA-1 PR.DS-1 PR.DS-6

🟡 ISO 27001:2022

A.12.2.1 A.14.2.1 A.14.2.5

🔗 References & Sources 8

🔗

https://github.com/xiaohaiyang-ai/Web-Security-Research/tree/main/FilePress/Shares-API-...

cna@vuldb.com

🔗

https://github.com/zyx0814/FilePress/

cna@vuldb.com

🔗

https://github.com/zyx0814/FilePress/commit/e20ec58414103f781858f2951d178e19b1736664

cna@vuldb.com

🔗

https://github.com/zyx0814/FilePress/issues/70

cna@vuldb.com

🔗

https://github.com/zyx0814/FilePress/pull/71

cna@vuldb.com

🔗

https://vuldb.com/submit/808819

cna@vuldb.com

🔗

https://vuldb.com/vuln/361923

cna@vuldb.com

🔗

https://vuldb.com/vuln/361923/cti

cna@vuldb.com

📊 CVSS Score

7.3

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityL — Low / Local

IntegrityL — Low / Local

AvailabilityL — Low / Local

📋 Quick Facts

Severity High

CVSS Score7.3

CWECWE-74

EPSS0.04%

Exploit No

Patch ✗ No

Published 2026-05-08

Source Feed nvd

🇸🇦 Saudi Risk Score

7.0

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-74

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-8133

Introduce Yourself

Sign In Required