- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 26 · 14 critical, 3 high, 7 medium
- Registry
- Packagist
Advisories 26
- CVE-2026-7733Medium 6.9
funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload
Affected: through 7.1.0-rc6.
- CVE-2026-2898Medium 5.1
funadmin Backend Endpoint AuthCloudService.php getMember deserialization
Affected: through 7.1.0-rc4.
- CVE-2026-2897Medium 4.8
funadmin Backend index.html cross site scripting
Affected: through 7.1.0-rc4.
- CVE-2026-2896Medium 6.9
funadmin Configuration Ajax.php setConfig improper authorization
Affected: through 7.1.0-rc4.
- CVE-2026-2895Medium 6.3
funadmin Member.php repass password recovery
Affected: through 7.1.0-rc4.
- CVE-2026-2894Medium 6.9
funadmin forget.html getMember information disclosure
Affected: through 7.1.0-rc4.
- CVE-2024-48230Critical 9.8
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.
Affected: through 5.0.2.
- CVE-2024-48229Critical 9.8
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.
Affected: through 5.0.2.
- CVE-2024-48228Medium 6.1
An issue was found in funadmin 5.0.2.
Affected: through 5.0.2.
- CVE-2024-48227High 7.5
Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).
Affected: through 5.0.2.
- CVE-2024-48226Critical 9.8
Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.
Affected: through 5.0.2.
- CVE-2024-48225Critical 9.1
Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.
Affected: through 5.0.2.
- CVE-2024-48224High 7.5
Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.
Affected: through 5.0.2.
- CVE-2024-48223Critical 9.8
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.
Affected: through 5.0.2.
- CVE-2024-48222Critical 9.8
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.
Affected: through 5.0.2.
Show all 26 advisoriesShow fewer advisories
- CVE-2024-48218Critical 9.8
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.
Affected: through 5.0.2.
- CVE-2024-48231High 7.2
Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.
Affected: through 5.0.2.
- CVE-2023-36097Unrated
funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
Affected: from 3.3.2, through 3.3.3.
- CVE-2023-24774Critical 9.8
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.
Affected: through 3.2.0.
- CVE-2023-24782Critical 9.8
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.
Affected: through 3.2.0.
- CVE-2023-24777Critical 9.8
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.
Affected: through 3.2.0.
- CVE-2023-24773Critical 9.8
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.
Affected: through 3.2.0.
- CVE-2023-24781Critical 9.8
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.
Affected: through 3.2.0.
- CVE-2023-24780Critical 9.8
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.
Affected: through 3.2.0.
- CVE-2023-24775Critical 9.8
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.
Affected: through 3.2.0.
- CVE-2023-24776Unrated
Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.
Affected: through 3.2.0.