FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111619 · Microsoft / collected KEV context

cve-program · CVE-2026-111619

• https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-orderby-sqli
• https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L93
• https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/filelist.php#L594-L642
• https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/collection/filelist.php#L453-L496
• https://github.com/zyx0814/FilePress
• https://www.vulncheck.com/advisories/filepress-through-3.0.1-sql-injection-via-asc-parameter-in-filelist-php

No related operational record is retained in the current change model.