CVE-2023-36097
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Versions 3.3.2 and 3.3.3 of funadmin are vulnerable to insecure file upload via plugin installation.
Risk Assessment
An attacker could exploit this vulnerability to upload malicious files, potentially leading to system compromise.
Recommendation
It is recommended to upgrade to the latest version of funadmin and implement strict controls on file uploads.
Other vulnerabilities in funadmin
See all- CVE-2026-121610High
A security flaw was discovered in funadmin 7.1.0 in the Curd::selectList function of /frontend/ajax/index (Frontend List Endpoint component). Manipulating the selectFields argument results in SQL injection. The attack can be executed remotely and the exploit has been released publicly.
- CVE-2026-7733High
A flaw has been found in funadmin up to version 7.1.0-rc6, affecting the function UploadService::chunkUpload in the file app/common/service/UploadService.php. Manipulation of the argument File leads to unrestricted file uploads.
Original NVD description (English source)
funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS