# funadmin/funadmin (Packagist) vulnerabilities 26 known vulnerabilities (14 critical, 3 high, 7 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/funadmin/funadmin ## Advisories (26) ### [CVE-2026-7733](https://cve.now/CVE-2026-7733): funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload - Severity: Medium 6.9 - Published: May 4, 2026 - Affected: through 7.1.0-rc6. ### [CVE-2026-2898](https://cve.now/CVE-2026-2898): funadmin Backend Endpoint AuthCloudService.php getMember deserialization - Severity: Medium 5.1 - Published: Feb 22, 2026 - Affected: through 7.1.0-rc4. ### [CVE-2026-2897](https://cve.now/CVE-2026-2897): funadmin Backend index.html cross site scripting - Severity: Medium 4.8 - Published: Feb 22, 2026 - Affected: through 7.1.0-rc4. ### [CVE-2026-2896](https://cve.now/CVE-2026-2896): funadmin Configuration Ajax.php setConfig improper authorization - Severity: Medium 6.9 - Published: Feb 21, 2026 - Affected: through 7.1.0-rc4. ### [CVE-2026-2895](https://cve.now/CVE-2026-2895): funadmin Member.php repass password recovery - Severity: Medium 6.3 - Published: Feb 21, 2026 - Affected: through 7.1.0-rc4. ### [CVE-2026-2894](https://cve.now/CVE-2026-2894): funadmin forget.html getMember information disclosure - Severity: Medium 6.9 - Published: Feb 21, 2026 - Affected: through 7.1.0-rc4. ### [CVE-2024-48230](https://cve.now/CVE-2024-48230): funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \\backend\\controller\\auth\\Auth.php. - Severity: Critical 9.8 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48229](https://cve.now/CVE-2024-48229): funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin. - Severity: Critical 9.8 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48228](https://cve.now/CVE-2024-48228): An issue was found in funadmin 5.0.2. - Severity: Medium 6.1 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48227](https://cve.now/CVE-2024-48227): Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS). - Severity: High 7.5 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48226](https://cve.now/CVE-2024-48226): Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield. - Severity: Critical 9.8 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48225](https://cve.now/CVE-2024-48225): Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile. - Severity: Critical 9.1 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48224](https://cve.now/CVE-2024-48224): Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile. - Severity: High 7.5 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48223](https://cve.now/CVE-2024-48223): Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist. - Severity: Critical 9.8 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48222](https://cve.now/CVE-2024-48222): Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit. - Severity: Critical 9.8 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48218](https://cve.now/CVE-2024-48218): Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list. - Severity: Critical 9.8 - Published: Oct 25, 2024 - Affected: through 5.0.2. ### [CVE-2024-48231](https://cve.now/CVE-2024-48231): Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \\backend\\controller\\auth\\Auth.php. - Severity: High 7.2 - Published: Oct 21, 2024 - Affected: through 5.0.2. ### [CVE-2023-36097](https://cve.now/CVE-2023-36097): funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install. - Severity: Unrated - Published: Jun 22, 2023 - Affected: from 3.3.2, through 3.3.3. ### [CVE-2023-24774](https://cve.now/CVE-2023-24774): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \\controller\\auth\\Auth.php. - Severity: Critical 9.8 - Published: Mar 10, 2023 - Affected: through 3.2.0. ### [CVE-2023-24782](https://cve.now/CVE-2023-24782): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit. - Severity: Critical 9.8 - Published: Mar 8, 2023 - Affected: through 3.2.0. ### [CVE-2023-24777](https://cve.now/CVE-2023-24777): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list. - Severity: Critical 9.8 - Published: Mar 8, 2023 - Affected: through 3.2.0. ### [CVE-2023-24773](https://cve.now/CVE-2023-24773): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list. - Severity: Critical 9.8 - Published: Mar 8, 2023 - Affected: through 3.2.0. ### [CVE-2023-24781](https://cve.now/CVE-2023-24781): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \\member\\MemberLevel.php. - Severity: Critical 9.8 - Published: Mar 7, 2023 - Affected: through 3.2.0. ### [CVE-2023-24780](https://cve.now/CVE-2023-24780): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns. - Severity: Critical 9.8 - Published: Mar 7, 2023 - Affected: through 3.2.0. ### [CVE-2023-24775](https://cve.now/CVE-2023-24775): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \\member\\Member.php. - Severity: Critical 9.8 - Published: Mar 7, 2023 - Affected: through 3.2.0. ### [CVE-2023-24776](https://cve.now/CVE-2023-24776): Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \\controller\\Addon.php. - Severity: Unrated - Published: Mar 6, 2023 - Affected: through 3.2.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/funadmin/funadmin Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.