303 matches found
CVE-2024-48218
Funadmin v5.0.2 is affected by a SQL injection in the /curd/table/list endpoint. The vulnerability is caused by improper input sanitization in that endpoint (supported by Veracode description and Snyk report citing the list method in curd/controller/Table.php). Exploitation could allow attackers ...
CVE-2024-48224
Funadmin v5.0.2 has an arbitrary file read vulnerability in the /curd/index/editfile endpoint. The issue is documented across multiple sources (NVD entry CVE-2024-48224 and Red Hat, Veracode, OSV, Snyk, GHSA advisories, CNNVD, PT Security) and is consistently described as an arbitrary file read/l...
CVE-2024-48225
Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile...
CVE-2024-48224
Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile...
CVE-2024-48223
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist...
CVE-2024-48218
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list...
FunAdmin 安全漏洞
FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which stems from a logic flaw in the Curd one-click command delete function that could lead to a denial of...
FunAdmin 安全漏洞
FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which originates from an arbitrary file read vulnerability in /curd/index/editfile...
CVE-2024-48222
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...
CVE-2024-48224
Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile...
CVE-2024-48227
Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service DOS...
CVE-2024-48223
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist...
CVE-2024-48230
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php...
PT-2024-33034 · Funadmin · Funadmin
Name of the Vulnerable Software and Affected Versions: Funadmin version 5.0.2 Description: The issue is related to an arbitrary file read vulnerability. It affects the /curd/index/editfile endpoint. There is no information provided about the estimated number of potentially affected devices...
CVE-2024-48223
Funadmin v5.0.2 is affected by a SQL injection in the /curd/table/fieldlist API endpoint. The root cause is improper handling/validation of input in that endpoint, enabling attacker-controlled SQL commands. Documented impact scope includes potential data disclosure/modification with high severity...
PT-2024-33038 · Funadmin · Funadmin
Name of the Vulnerable Software and Affected Versions: funadmin version 5.0.2 Description: An issue was found in the selectfiles method in backendcontrollersysAttachh.php, where it directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site...
CVE-2024-48226
Funadmin 5.0.2 has a SQL injection vulnerability in curd/table/savefield. The issue arises from improper input handling, enabling manipulation of database queries and potential unauthorized data access/alteration. This is confirmed across multiple sources (GHSA, OSV, NVD/NVD-derived entries, Vera...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the selectFields parameter in the index function in Auth.php. Remediation There is no fixed version for funadmin/funadmin. References - GitHub Issue - Vulnerable Code...
