CVE-2024-48231

CVE-2024-48231 affects Funadmin 5.0.2. The vulnerability is an SQL Injection in the backend/auth/Auth.php: the index() method mishandles the selectFields parameter, enabling manipulation of database queries. This is confirmed across multiple sources (Veracode, Snyk, GHSA, OSV, NVD) describing a S...

CVE-2024-48227

CVE-2024-48227 concerns Funadmin 5.0.2, where a logical flaw in the Curd one-click command deletion function can cause a Denial of Service (DOS). The available documents identify the affected software and the faulty delete logic as the root cause, and they consistently describe impact as DoS. No ...

CVE-2024-48224

Funadmin v5.0.2 has an arbitrary file read vulnerability in the /curd/index/editfile endpoint. The issue is documented across multiple sources (NVD entry CVE-2024-48224 and Red Hat, Veracode, OSV, Snyk, GHSA advisories, CNNVD, PT Security) and is consistently described as an arbitrary file read/l...

CVE-2026-2896

Funadmin up to 7.1.0-rc4 is affected by CVE-2026-2896 due to a flaw in the setConfig function of app/backend/controller/Ajax.php (Configuration Handler). The issue allows remote manipulation to cause improper authorization. Exploitation is possible over the network with no privileges and no user ...