CVE-2025-14966
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controller/Backend.php of the component Backend Controller. Executing a manipulation of the argument custom/searchField can lead to SQL injection. It is possible to launch the attack remotely, and the exploit has been publicly disclosed.
Risk Assessment
The vulnerability allows a remote attacker to perform SQL injection, potentially leading to unauthorized database access or modification. The public availability of the exploit increases the risk of exploitation.
Recommendation
Update FastAdmin to the latest version if available, or apply mitigations (e.g., WAF). Restrict access to the administrative panel.
Other vulnerabilities in FastAdmin
See all- CVE-2026-51775Critical
SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to execute arbitrary code via the application/common/controller/Backend.php component.
- CVE-2026-102247Medium
A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602 in the file application/database.php of the Database Management component. Manipulation leads to execution with unnecessary privileges. The attack can be launched remotely, and the exploit is public.
- CVE-2026-86244Medium
A security vulnerability was detected in FastAdmin up to 1.2.0.20210401_beta. The affected function is register/login in the file application/index/controller/User.php (User Controller component). Manipulation of the url argument leads to cross-site scripting. The attack may be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 1.2.1.20210731_beta addresses this issue.
Original NVD description (English source)
A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controller/Backend.php of the component Backend Controller. Executing a manipulation of the argument custom/searchField can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS