Funadmin

Every one of the 27 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.CVE-2023-24775Funadmin · CVSS 9.8 · 20% likely

   CWE-89

2. Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.CVE-2023-24776Funadmin · 1.4% likely

   CWE-94

3. Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.CVE-2023-24774Funadmin · CVSS 9.8 · 0.9% likely

   CWE-89

4. funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.CVE-2023-36097Funadmin · 0.9% likely

   CWE-434

5. Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.CVE-2023-24780Funadmin · CVSS 9.8 · 0.8% likely

   CWE-89

6. Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.CVE-2023-24781Funadmin · CVSS 9.8 · 0.7% likely

   CWE-89

7. Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.CVE-2023-24782Funadmin · CVSS 9.8 · 0.7% likely

   CWE-89

8. Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.CVE-2023-24777Funadmin · CVSS 9.8 · 0.7% likely

   CWE-89

9. Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.CVE-2023-24773Funadmin · CVSS 9.8 · 0.7% likely

   CWE-89

10. Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.CVE-2024-48224Funadmin · CVSS 7.5 · 0.7% likely

    CWE-22

11. Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.CVE-2024-48222Funadmin · CVSS 9.8 · 0.6% likely

    CWE-89

12. Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.CVE-2024-48225Funadmin · CVSS 9.1 · 0.6% likely
13. Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.CVE-2024-48226Funadmin · CVSS 9.8 · 0.6% likely

    CWE-89

14. Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.CVE-2024-48223Funadmin · CVSS 9.8 · 0.6% likely

    CWE-89

15. Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.CVE-2024-48218Funadmin · CVSS 9.8 · 0.6% likely

    CWE-89

16. Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).CVE-2024-48227Funadmin · CVSS 7.5 · 0.6% likely
17. Funadmin Cx.php tagLoad cross site scriptingCVE-2023-2477Funadmin · CVSS 3.5 · 0.5% likely

    CWE-79

18. Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.CVE-2024-48231Funadmin · CVSS 7.2 · 0.5% likely

    CWE-89

19. funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.CVE-2024-48230Funadmin · CVSS 9.8 · 0.5% likely

    CWE-89

20. funadmin forget.html getMember information disclosureCVE-2026-2894Funadmin · CVSS 5.3 · 0.5% likely

    CWE-200

21. funadmin Member.php repass password recoveryCVE-2026-2895Funadmin · CVSS 3.7 · 0.5% likely

    CWE-640

22. funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.CVE-2024-48229Funadmin · CVSS 9.8 · 0.4% likely

    CWE-89

23. funadmin Configuration Ajax.php setConfig improper authorizationCVE-2026-2896Funadmin · CVSS 7.3 · 0.3% likely

    CWE-266

24. An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter witho…CVE-2024-48228Funadmin · CVSS 6.1 · 0.3% likely

    CWE-79

25. funadmin Backend Endpoint AuthCloudService.php getMember deserializationCVE-2026-2898Funadmin · CVSS 5.5 · 0.3% likely

    CWE-502

26. funadmin Frontend List Endpoint index selectList sql injectionCVE-2026-121610Funadmin · CVSS 7.3 · 0.3% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.