Skip to content
Noroxi

funadmin records

26 published records for vendor funadmin.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 23
  2. 24
  3. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

26 records
  • CVE-2023-24775
    45Plan

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    funadmin · funadminMar 7, 2023

  • CVE-2023-24776
    39Monitor

    Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    funadmin · funadminMar 6, 2023

  • CVE-2023-24774
    39Monitor

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    funadmin · funadminMar 10, 2023

  • CVE-2023-36097
    39Monitor

    funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.

    CriticalCVSS 9.8No exploitEPSS 1%

    funadmin · funadminJun 22, 2023

  • CVE-2023-24780
    39Monitor

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.

    CriticalCVSS 9.8No exploitEPSS 1%

    funadmin · funadminMar 7, 2023

  • CVE-2023-24777
    39Monitor

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.

    CriticalCVSS 9.8No exploitEPSS 1%

    funadmin · funadminMar 8, 2023

  • CVE-2023-24773
    39Monitor

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.

    CriticalCVSS 9.8No exploitEPSS 1%

    funadmin · funadminMar 8, 2023

  • CVE-2023-24781
    39Monitor

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    funadmin · funadminMar 7, 2023

  • CVE-2023-24782
    39Monitor

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.

    CriticalCVSS 9.8No exploitEPSS 1%

    funadmin · funadminMar 8, 2023

  • CVE-2024-48222
    28Monitor

    Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.

    HighCVSS 7.2No exploitEPSS 1%

    funadmin · funadminOct 25, 2024

  • CVE-2024-48223
    28Monitor

    Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.

    HighCVSS 7.2No exploitEPSS 1%

    funadmin · funadminOct 25, 2024

  • CVE-2024-48218
    28Monitor

    Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.

    HighCVSS 7.2No exploitEPSS 1%

    funadmin · funadminOct 25, 2024

  • CVE-2024-48226
    28Monitor

    Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.

    HighCVSS 7.2No exploitEPSS 1%

    funadmin · funadminOct 25, 2024

  • CVE-2024-48231
    28Monitor

    Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.

    HighCVSS 7.2No exploitEPSS 1%

    funadmin · funadminOct 21, 2024

  • CVE-2024-48230
    28Monitor

    funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.

    HighCVSS 7.2No exploitEPSS 0%

    funadmin · funadminOct 25, 2024

  • CVE-2024-48229
    28Monitor

    funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.

    HighCVSS 7.2No exploitEPSS 0%

    funadmin · funadminOct 25, 2024

  • CVE-2024-48225
    26Monitor

    Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.

    MediumCVSS 6.5No exploitEPSS 1%

    funadmin · funadminOct 25, 2024

  • CVE-2023-2477
    24Monitor

    Funadmin Cx.php tagLoad cross site scripting

    MediumCVSS 6.1No exploitEPSS 1%

    funadmin · funadminMay 2, 2023

  • CVE-2024-48228
    24Monitor

    An issue was found in funadmin 5.0.2.

    MediumCVSS 6.1No exploitEPSS 0%

    funadmin · funadminOct 25, 2024

  • CVE-2026-2894
    22Monitor

    funadmin forget.html getMember information disclosure

    MediumCVSS 5.5No exploitEPSS 1%

    funadmin · funadminFeb 21, 2026

  • CVE-2026-2896
    22Monitor

    funadmin Configuration Ajax.php setConfig improper authorization

    MediumCVSS 5.5No exploitEPSS 0%

    funadmin · funadminFeb 21, 2026

  • CVE-2024-48224
    19Monitor

    Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.

    MediumCVSS 4.9No exploitEPSS 1%

    funadmin · funadminOct 25, 2024

  • CVE-2024-48227
    19Monitor

    Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).

    MediumCVSS 4.9No exploitEPSS 1%

    funadmin · funadminOct 25, 2024

  • CVE-2026-2895
    11Monitor

    funadmin Member.php repass password recovery

    LowCVSS 2.9No exploitEPSS 1%

    funadmin · funadminFeb 21, 2026

  • CVE-2026-2898
    8Monitor

    funadmin Backend Endpoint AuthCloudService.php getMember deserialization

    LowCVSS 2.0Proof of conceptEPSS 0%

    funadmin · funadminFeb 21, 2026