Priority HIGH 82
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00486 · Published 2024-10-25 · No fix listed CWE-89
Priority HIGH 82
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00446 · Published 2024-10-25 · No fix listed CWE-89
Priority HIGH 82
Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00557 · Published 2024-10-25 · No fix listed CWE-89
Priority HIGH 82
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00557 · Published 2024-10-25 · No fix listed CWE-89
Priority HIGH 82
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00582 · Published 2024-10-25 · No fix listed CWE-89
Priority HIGH 82
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00557 · Published 2024-10-25 · No fix listed CWE-89
Priority HIGH 82
funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00872 · Published 2023-06-22 · No fix listed CWE-434
Priority HIGH 82
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00741 · Published 2023-03-08 · No fix listed CWE-89
Priority HIGH 82
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00741 · Published 2023-03-08 · No fix listed CWE-89
Priority HIGH 82
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.19763 · Published 2023-03-07 · No fix listed CWE-89
Priority HIGH 82
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00877 · Published 2023-03-10 · No fix listed CWE-89
Priority HIGH 82
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00741 · Published 2023-03-08 · No fix listed CWE-89
Priority HIGH 78
Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0056 · Published 2024-10-25 · No fix listed CWE-89
Priority HIGH 76
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00747 · Published 2023-03-07 · No fix listed CWE-89
Priority HIGH 76
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00814 · Published 2023-03-07 · No fix listed CWE-89
Priority HIGH 72
Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00554 · Published 2024-10-25 · No fix listed
Priority HIGH 72
Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00653 · Published 2024-10-25 · No fix listed CWE-22
Priority HIGH 70
A weakness has been identified in funadmin up to 7.1.0-rc4.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00325 · Published 2026-02-21 · No fix listed CWE-266
Priority HIGH 70
A vulnerability was identified in funadmin up to 7.1.0-rc4.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00465 · Published 2026-02-21 · No fix listed CWE-200
Priority HIGH 67
Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.005 · Published 2024-10-21 · No fix listed CWE-89
Priority MEDIUM 61
A security flaw has been discovered in funadmin up to 7.1.0-rc4.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00456 · Published 2026-02-21 · No fix listed CWE-640
Priority MEDIUM 60
An issue was found in funadmin 5.0.2.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00294 · Published 2024-10-25 · No fix listed CWE-79
Priority MEDIUM 56
A vulnerability was detected in funadmin up to 7.1.0-rc4.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00271 · Published 2026-02-22 · No fix listed CWE-20
Priority MEDIUM 55
A security vulnerability has been detected in funadmin up to 7.1.0-rc4.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00241 · Published 2026-02-22 · No fix listed CWE-79
Priority MEDIUM 52
Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01405 · Published 2023-03-06 · No fix listed CWE-94
Load more
THREATIST.IORead the docs