FunAdmin SQL Injection Vulnerability

FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which stems from a SQL injection vulnerability in the selectFields parameter of the index method of...

Unrestricted File Upload

funadmin/funadmin is vulnerable to Unrestricted File Uploads. The vulnerability exists in localinstall function at Addon.php due to not restricting plugin files that can be uploaded which allows an attacker to perform unauthorized actions...

GHSA-5M3M-Q8CQ-77G4 fuadmin vulnerable to insecure file upload

funadmin v3.3.2 and v3.3.3 are vulnerable to insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

Design/Logic Flaw

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097: Unrestricted Upload of File with Dangerous Type

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

CVE-2023-36097

funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install...

FunAdmin code issue vulnerabilities

FunAdmin is FunAdmin open source a lightweight and high quality backend development system based on ThinkPHP6 + Layui development . FunAdmin version 3.3.2 and 3.3.3 version of a security vulnerability , the vulnerability stems from allowing the installation of plug-ins through the upload of...

PT-2023-25428

Name of the Vulnerable Software and Affected Versions funadmin versions 3.3.2 through 3.3.3 Description The issue concerns insecure file upload via the plugins install. Recommendations For versions 3.3.2 and 3.3.3, consider disabling the plugins install feature until a patch is available. Restric...

CVE-2023-36097

CVE-2023-36097 affects FunAdmin v3.3.2 and v3.3.3. The issue is an insecure file upload in the plugin installation process, caused by insufficient validation/restrictions on uploaded plugin files. This vulnerability allows an attacker to upload malicious files via the local install mechanism, pot...

Cross-Site Scripting (XSS)

funadmin is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the JS file name which could be maliciously constructed via tagLoad function of the file Cx.php, which allows an attacker to inject and execute malicious JavaScript on the victim's browser...

CVE-2023-2477

A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability is the function tagLoad of the file Cx.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

Cross site scripting

A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability is the function tagLoad of the file Cx.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

CVE-2023-2477

A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability is the function tagLoad of the file Cx.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

CVE-2023-2477 Funadmin Cx.php tagLoad cross site scripting

A vulnerability was found in Funadmin up to 3.2.3. It has been declared as problematic. Affected by this vulnerability is the function tagLoad of the file Cx.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. The exploit has been disclos...

CVE-2023-2477

CVE-2023-2477 affects Funadmin up to version 3.2.3. The vulnerability lies in the function tagLoad in file Cx.php where manipulating the argument file enables Cross-Site Scripting (XSS) . Exploitation can be carried out remotely and public disclosures exist. A practical mitigation mentioned in so...