Funadmin vulnerabilities
We track 4 vulnerabilities in Funadmin products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest Funadmin vulnerabilities
- 7.3 High severity
funadmin: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be
- 7.3 High severity
funadmin: Improper Access Control
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestrict
- 8.1 High severity
funadmin: Weak Password Recovery Mechanism for Forgotten Password
A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remo
- 9.1 Critical severity
funadmin: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The ex