303 matches found
SQL Injection
Funadmin is vulnerable to SQL injection. The vulnerability is due to improper input validation in the Curd one-click command mode plugin, allowing user-supplied data to be directly included in SQL queries without sanitization. Attackers can exploit this to execute arbitrary SQL commands...
Denial Of Service (DoS)
funadmin/funadmin is vulnerable to a Denial of Service DOS. The vulnerability is due to a logical flaw in the Curd one-click command deletion function, which can lead to a DOS condition...
SQL Injection
funadmin/funadmin is vulnerable to SQL Injection. The vulnerability is due to improper validation of the parentField parameter in the index method of \backend\controller\auth\Auth.php...
SQL Injection
funadmin/funadmin is vulnerable to SQL injection. The vulnerability is due to insufficient input validation in the /curd/table/edit endpoint, which allows untrusted data to be directly used in SQL queries without proper sanitization or escaping...
Arbitrary File Deletion
funadmin/funadmin is vulnerable to Arbitrary File Deletion. The vulnerability is due to a lack of proper access control in the /curd/index/delfile endpoint, which allows unauthorized users to delete files...
GHSA-J9WP-X5Q5-XH2F Funadmin Cross-site Scripting vulnerability
An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...
Funadmin Cross-site Scripting vulnerability
An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...
CVE-2024-48228
An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...
SQL injection in funadmin
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection due to improper authorization via the add method in controller\Index.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for funadmin/funadmin...
GHSA-2MV8-JJM5-F3HR SQL injection in funadmin
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the parentField parameter in the index method of backend/controller/auth/Auth.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for...
GHSA-H345-R48X-G68F SQL injection in funadmin
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin...
SQL injection in funadmin
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php...
GHSA-H4PX-9VMP-P7PV SQL injection in funadmin
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list...
GHSA-X2FR-VJ74-5H35 SQL injection in funadmin
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the edit method in controller\Table.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for funadmin/funadmin. References - GitHub Issue...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection through the app\curd\controller\Table.php file. An attacker can manipulate SQL queries and access or alter database information without proper authorization. Remediation There is no fixed version for funadmin/funadmin...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS via the getSystemTable and Delete methods in the common.php file. An attacker can disrupt service availability by exploiting this logic flaw to delete critical commands. Details Denial of Service DoS describes a...