26 results · Feed
-
High 7.3
funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestric…
-
Medium 5.5CVE-2026-2898 Public exploit
funadmin Backend Endpoint AuthCloudService.php getMember deserialization
A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserializatio…
-
Low 2.4
funadmin Backend index.html cross site scripting
A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html of the component Backend Interface. The manipulation of the argument Value leads to cross site script…
-
High 7.3
funadmin Configuration Ajax.php setConfig improper authorization
A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Configuration Handler. Executing a manipulation can lead to improper authorization. The attack can be …
-
Low 3.7
funadmin Member.php repass password recovery
A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Rem…
-
Medium 5.3
funadmin forget.html getMember information disclosure
A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The e…
-
Critical 9.8
SQL injection in funadmin
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.
-
Medium 6.1
Funadmin Cross-site Scripting vulnerability
An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting (XSS).
-
Critical 9.8
SQL injection in funadmin
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.
-
High 7.5
SQL injection in funadmin
Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.
-
High 7.5
Logic flaw in Funadmin
Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).
-
Critical 9.8
SQL injection in funadmin
Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.
-
Critical 9.8
SQL injection in funadmin
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.
-
Critical 9.8
SQL injection in funadmin
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.
-
Critical 9.1
SQL injection in funadmin
Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.
-
Critical 9.8
SQL injection in funadmin
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.
-
High 7.2
SQL injection in funadmin
Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.
-
Critical 9.8
fuadmin vulnerable to insecure file upload
funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
-
Critical 9.8
Funadmin vulnerable to SQL injection
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.
-
Critical 9.8
Remote code execution in Funadmin
Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.