CVE-2026-121610
HighCVSS 7.3Summary
A security flaw was discovered in funadmin 7.1.0 in the Curd::selectList function of /frontend/ajax/index (Frontend List Endpoint component). Manipulating the selectFields argument results in SQL injection. The attack can be executed remotely and the exploit has been released publicly.
Risk Assessment
SQL injection may allow an attacker to access or modify database data. The public availability of the exploit increases the risk of exploitation.
Recommendation
Restrict access to the /frontend/ajax/index endpoint and enforce parameter validation in the application. Monitor logs for suspicious queries, as the vendor did not respond to the disclosure.
Other vulnerabilities in funadmin
See all- CVE-2026-7733High
A flaw has been found in funadmin up to version 7.1.0-rc6, affecting the function UploadService::chunkUpload in the file app/common/service/UploadService.php. Manipulation of the argument File leads to unrestricted file uploads.
- CVE-2023-36097Critical
Versions 3.3.2 and 3.3.3 of funadmin are vulnerable to insecure file upload via plugin installation.
Original NVD description (English source)
A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS