334 matches found
CVE-2024-48228
The funadmin backend development system, version 5.0.2 , is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input. The root cause is located in the selectfiles method within the ackend railer ys ough.php (also cited as ackend railer ys ough.php or ackend railer ys ou...
CVE-2024-48228
An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...
CVE-2024-48229: Improper Neutralization of Special Elements used in an SQL Command
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin...
CVE-2024-48224: Improper Limitation of a Pathname to a Restricted Directory
Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile...
CVE-2024-48218: Improper Neutralization of Special Elements used in an SQL Command
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list...
FunAdmin 安全漏洞
FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which stems from the selectfiles method in ackendcontrollersysAttachh.php directly depositing incoming paramete...
CVE-2024-48225
The funadmin/funadmin framework, specifically version 5.0.2 , is vulnerable to SQL Injection and Arbitrary File Deletion . The root cause is a lack of proper access control and insecure handling within the delfile method located in controller\Index.php (accessible via the /curd/index/delfile endp...
CVE-2024-48230
The funadmin 5.0.2 version is vulnerable to SQL Injection due to improper validation of the parentField parameter within the index method of the \backend\controller\auth\Auth.php file. An attacker can exploit this flaw to manipulate SQL queries, potentially allowing them to access or modify data ...
FunAdmin 安全漏洞
FunAdmin is FunAdmin open source development based on ThinkPHP6 + Layui development of a lightweight high-color backend development system. A security vulnerability exists in FunAdmin version 5.0.2, which originates from an SQL injection vulnerability in the parentField parameter of the index...
CVE-2024-48230: Improper Neutralization of Special Elements used in an SQL Command
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php...
PT-2024-33041 · Funadmin · Funadmin
Name of the Vulnerable Software and Affected Versions: funadmin version 5.0.2 Description: The issue is related to SQL Injection via the parentField parameter in the index method of backendcontrollerauthAuth.php. There is no information provided about the estimated number of potentially affected...
PT-2024-33038 · Funadmin · Funadmin
Name of the Vulnerable Software and Affected Versions: funadmin version 5.0.2 Description: An issue was found in the selectfiles method in backendcontrollersysAttachh.php, where it directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site...
CVE-2024-48224
Funadmin v5.0.2 is vulnerable to an arbitrary file read vulnerability within the /curd/index/editfile endpoint. Additionally, documentation indicates that the application is susceptible to SQL injection due to improper input sanitization in the editfile method located in the controller Index.php ...
CVE-2024-48226
Funadmin 5.0.2 is vulnerable to SQL Injection due to improper input validation in the curd/table/savefield functionality (specifically within the app\curd\controller\Table.php file). An attacker can exploit this flaw to manipulate database queries, potentially leading to unauthorized access to or...
FunAdmin 安全漏洞
FunAdmin is FunAdmin open source a lightweight and high-color backend development system based on ThinkPHP6+Layui development. A security vulnerability exists in FunAdmin version 5.0.2, which originates from an SQL injection vulnerability in curd/table/savefield...
CVE-2024-48229
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin...
CVE-2024-48222
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit...
PT-2024-33034 · Funadmin · Funadmin
Name of the Vulnerable Software and Affected Versions: Funadmin version 5.0.2 Description: The issue is related to an arbitrary file read vulnerability. It affects the /curd/index/editfile endpoint. There is no information provided about the estimated number of potentially affected devices...
PT-2024-33032 · Funadmin · Funadmin
Name of the Vulnerable Software and Affected Versions: Funadmin version 5.0.2 Description: The issue is a SQL injection vulnerability located in the /curd/table/edit API endpoint. This allows for potential exploitation by injecting malicious SQL code. Recommendations: For Funadmin version 5.0.2,...