Vulnerabilities

TI-2026-02492 CVE-2026-2898 · GHSA-gcxp-xg77-798j

funadmin Backend Endpoint AuthCloudService.php getMember deserialization

MEDIUM 56

A vulnerability was detected in funadmin up to 7.1.0-rc4.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00271 Published 2026-02-22 No fix listed CWE-20

TI-2026-02491 CVE-2026-2897 · GHSA-rfh7-7v27-6p9r

funadmin Backend index.html cross site scripting

MEDIUM 55

A security vulnerability has been detected in funadmin up to 7.1.0-rc4.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00241 Published 2026-02-22 No fix listed CWE-79

TI-2026-02490 CVE-2026-2896 · GHSA-5m2g-4cf6-c3rg

funadmin Configuration Ajax.php setConfig improper authorization

HIGH 70

A weakness has been identified in funadmin up to 7.1.0-rc4.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2026-02-21 No fix listed CWE-266

TI-2026-02489 CVE-2026-2895 · GHSA-fmr2-m7gc-577w

funadmin Member.php repass password recovery

MEDIUM 61

A security flaw has been discovered in funadmin up to 7.1.0-rc4.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00456 Published 2026-02-21 No fix listed CWE-640

TI-2026-02488 CVE-2026-2894 · GHSA-8hhx-xq9j-xwfj

funadmin forget.html getMember information disclosure

HIGH 70

A vulnerability was identified in funadmin up to 7.1.0-rc4.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00465 Published 2026-02-21 No fix listed CWE-200

TI-2024-32317 CVE-2024-48230 · GHSA-2mv8-jjm5-f3hr

funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index…

HIGH 82

funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00486 Published 2024-10-25 No fix listed CWE-89

TI-2024-32316 CVE-2024-48229 · GHSA-h345-r48x-g68f

funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.

HIGH 82

funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00446 Published 2024-10-25 No fix listed CWE-89

TI-2024-32315 CVE-2024-48228 · GHSA-j9wp-x5q5-xh2f

An issue was found in funadmin 5.0.2.

MEDIUM 60

An issue was found in funadmin 5.0.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00294 Published 2024-10-25 No fix listed CWE-79

TI-2024-32314 CVE-2024-48227 · GHSA-r9v5-q97m-rj5g

Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which…

HIGH 72

Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00554 Published 2024-10-25 No fix listed

TI-2024-32313 CVE-2024-48226 · GHSA-9gw3-qr2f-3vg5

Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.

HIGH 82

Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00557 Published 2024-10-25 No fix listed CWE-89

TI-2024-32312 CVE-2024-48225 · GHSA-vw6x-c5rg-jmjp

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.

HIGH 78

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0056 Published 2024-10-25 No fix listed CWE-89

TI-2024-32311 CVE-2024-48224 · GHSA-6j8f-88mh-r9vq

Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.

HIGH 72

Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00653 Published 2024-10-25 No fix listed CWE-22

TI-2024-32310 CVE-2024-48223 · GHSA-x2fr-vj74-5h35

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.

HIGH 82

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00557 Published 2024-10-25 No fix listed CWE-89

TI-2024-32309 CVE-2024-48222 · GHSA-5g66-93qv-565j

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.

HIGH 82

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00582 Published 2024-10-25 No fix listed CWE-89

TI-2024-32308 CVE-2024-48218 · GHSA-h4px-9vmp-p7pv

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.

HIGH 82

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00557 Published 2024-10-25 No fix listed CWE-89

TI-2024-32318 CVE-2024-48231 · GHSA-7pp4-388x-2xqj

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index…

HIGH 67

Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.005 Published 2024-10-21 No fix listed CWE-89

TI-2023-18116 CVE-2023-36097 · GHSA-5m3m-q8cq-77g4

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.

HIGH 82

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00872 Published 2023-06-22 No fix listed CWE-434

TI-2023-02326 CVE-2023-2477 · GHSA-593x-8hh8-7h6v

Funadmin Cx.php tagLoad cross site scripting

LOW 28

A vulnerability was found in Funadmin up to 3.2.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00546 Published 2023-05-02 No fix listed CWE-79

TI-2023-10289 CVE-2023-24774 · GHSA-jx2x-fg9p-7gc7

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the…

HIGH 82

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00877 Published 2023-03-10 No fix listed CWE-89

TI-2023-10295 CVE-2023-24782 · GHSA-qhq8-2f3m-gxvp

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id…

HIGH 82

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00741 Published 2023-03-08 No fix listed CWE-89

TI-2023-10292 CVE-2023-24777 · GHSA-pvp6-53r9-8vxh

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.

HIGH 82

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00741 Published 2023-03-08 No fix listed CWE-89

TI-2023-10288 CVE-2023-24773 · GHSA-m8wf-wmwh-jw2m

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id…

HIGH 82

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00741 Published 2023-03-08 No fix listed CWE-89

TI-2023-10294 CVE-2023-24781 · GHSA-vhrv-9f9g-rfrx

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the…

HIGH 76

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00747 Published 2023-03-07 No fix listed CWE-89

TI-2023-10293 CVE-2023-24780 · GHSA-7pmh-8qjj-4q36

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id…

HIGH 76

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00814 Published 2023-03-07 No fix listed CWE-89

TI-2023-10290 CVE-2023-24775 · GHSA-v43v-pv95-jc55

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the…

HIGH 82

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.19763 Published 2023-03-07 No fix listed CWE-89

Vulnerabilities

Filters