CVE-2024-48226

Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield...

CVE-2024-48224: Improper Limitation of a Pathname to a Restricted Directory

Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile...

CVE-2024-48226

Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield...

CVE-2024-48225

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...

CVE-2024-48228

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...

CVE-2024-48218

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list...

CVE-2024-48224

Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile...

CVE-2024-48225

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...

CVE-2024-48218

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list...

CVE-2024-48229

funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin...

CVE-2024-48225

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...

CVE-2024-48225: Undefined Security Weakness

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...

CVE-2024-48222

Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...

CVE-2024-48228

The funadmin backend development system, version 5.0.2 , is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input. The root cause is located in the selectfiles method within the ackend railer ys ough.php (also cited as ackend railer ys ough.php or ackend railer ys ou...

PT-2024-33038 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: funadmin version 5.0.2 Description: An issue was found in the selectfiles method in backendcontrollersysAttachh.php, where it directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site...

CVE-2024-48228

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...

CVE-2024-48229

funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin...

Funadmin security vulnerabilities

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in Funadmin version 5.0.2, which originates from an arbitrary file deletion vulnerability in /curd/index/delfile...

CVE-2024-48225

Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...

CVE-2024-48228

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...