FU
Product
funadmin
27
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 9Medium 8Low 0
Watch
Add funadmin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-36097 | 9.8 | Jun 22 | funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install Affected: 3.3.2; 3.3.3 |
| CVE-2023-24774 | 9.8 | Mar 10 | Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php Affected: 3.2.0 |
| CVE-2023-24773 | 9.8 | Mar 8 | Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list Affected: 3.2.0 |
| CVE-2023-24782 | 9.8 | Mar 8 | Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit Affected: 3.2.0 |
| CVE-2023-24777 | 9.8 | Mar 8 | Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list Affected: 3.2.0 |
| CVE-2023-24781 | 9.8 | Mar 7 | Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php Affected: 3.2.0 |
| CVE-2023-24780 | 9.8 | Mar 7 | Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns Affected: 3.2.0 |
| CVE-2023-24775 | 9.8 | Mar 7 | Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php Affected: 3.2.0 |
| CVE-2023-24776 | 9.8 | Mar 6 | Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php Affected: 3.2.0 |
| CVE-2026-2894 | 9.1 | Feb 21 | funadmin forget.html getMember information disclosure Affected: 7.1.0-rc1; 7.1.0-rc2; 7.1.0-rc3; 7.1.0-rc4 |
| CVE-2026-2895 | 8.1 | Feb 21 | funadmin Member.php repass password recovery Affected: 7.1.0-rc1; 7.1.0-rc2; 7.1.0-rc3; 7.1.0-rc4 |
| CVE-2026-7733 | 7.3 | May 4 | funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload Affected: 7.1.0-rc1; 7.1.0-rc2; 7.1.0-rc3; 7.1.0-rc4; 7.1.0-rc5; 7.1.0-rc6 |
| CVE-2024-48222 | 7.2 | Oct 25 | Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit Affected: 5.0.2 |
| CVE-2024-48223 | 7.2 | Oct 25 | Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist Affected: 5.0.2 |
| CVE-2024-48226 | 7.2 | Oct 25 | Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield Affected: 5.0.2 |
| CVE-2024-48229 | 7.2 | Oct 25 | funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin Affected: 5.0.2 |
| CVE-2024-48230 | 7.2 | Oct 25 | funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php Affected: 5.0.2 |
| CVE-2024-48218 | 7.2 | Oct 25 | Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list Affected: 5.0.2 |
| CVE-2024-48231 | 7.2 | Oct 21 | Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php Affected: 5.0.2 |
| CVE-2026-2898 | 6.5 | Feb 22 | funadmin Backend Endpoint AuthCloudService.php getMember deserialization Affected: 7.1.0-rc1; 7.1.0-rc2; 7.1.0-rc3; 7.1.0-rc4 |
| CVE-2024-48225 | 6.5 | Oct 25 | Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile Affected: 5.0.2 |
| CVE-2024-48228 | 6.1 | Oct 25 | An issue was found in funadmin 5.0.2 Affected: 5.0.2 |
| CVE-2023-2477 | 6.1 | May 2 | Funadmin Cx.php tagLoad cross site scripting Affected: through 3.2.3 |
| CVE-2026-2896 | 5.3 | Feb 21 | funadmin Configuration Ajax.php setConfig improper authorization Affected: 7.1.0-rc1; 7.1.0-rc2; 7.1.0-rc3; 7.1.0-rc4 |
| CVE-2024-48227 | 4.9 | Oct 25 | Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS) Affected: 5.0.2 |
| CVE-2024-48224 | 4.9 | Oct 25 | Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile Affected: 5.0.2 |
| CVE-2026-2897 | 4.8 | Feb 22 | funadmin Backend index.html cross site scripting Affected: 7.1.0-rc1; 7.1.0-rc2; 7.1.0-rc3; 7.1.0-rc4 |
Showing 27