https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2898.htmlhttps://patchthecve.com/cve/CVE-2026-2898.htmlWed, 17 Jun 2026 10:31:59 +0000MEDIUM 5.5: A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserialization. The attack may be performed from remothttps://patchthecve.com/cve/CVE-2026-2897.htmlhttps://patchthecve.com/cve/CVE-2026-2897.htmlWed, 17 Jun 2026 10:31:59 +0000LOW 2.4: A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html of the component Backend Interface. The manipulation of the argument Value leads to cross site scripting. The attack is possible to be carriedhttps://patchthecve.com/cve/CVE-2026-2896.htmlhttps://patchthecve.com/cve/CVE-2026-2896.htmlWed, 17 Jun 2026 10:31:59 +0000HIGH 7.3: A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Configuration Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been mhttps://patchthecve.com/cve/CVE-2026-2895.htmlhttps://patchthecve.com/cve/CVE-2026-2895.htmlWed, 17 Jun 2026 10:31:59 +0000LOW 3.7: A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possiblhttps://patchthecve.com/cve/CVE-2026-2894.htmlhttps://patchthecve.com/cve/CVE-2026-2894.htmlWed, 17 Jun 2026 10:31:59 +0000MEDIUM 5.3: A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might behttps://patchthecve.com/cve/CVE-2024-48228.htmlhttps://patchthecve.com/cve/CVE-2024-48228.htmlWed, 17 Jun 2026 07:58:19 +0000MEDIUM 6.1: An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting (XSS).https://patchthecve.com/cve/CVE-2024-48230.htmlhttps://patchthecve.com/cve/CVE-2024-48230.htmlWed, 17 Jun 2026 07:58:19 +0000HIGH 7.2: funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.https://patchthecve.com/cve/CVE-2024-48229.htmlhttps://patchthecve.com/cve/CVE-2024-48229.htmlWed, 17 Jun 2026 07:58:19 +0000HIGH 7.2: funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.https://patchthecve.com/cve/CVE-2024-48227.htmlhttps://patchthecve.com/cve/CVE-2024-48227.htmlWed, 17 Jun 2026 07:58:18 +0000MEDIUM 4.9: Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).https://patchthecve.com/cve/CVE-2024-48226.htmlhttps://patchthecve.com/cve/CVE-2024-48226.htmlWed, 17 Jun 2026 07:58:18 +0000HIGH 7.2: Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.https://patchthecve.com/cve/CVE-2024-48225.htmlhttps://patchthecve.com/cve/CVE-2024-48225.htmlWed, 17 Jun 2026 07:58:18 +0000MEDIUM 6.5: Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.https://patchthecve.com/cve/CVE-2024-48224.htmlhttps://patchthecve.com/cve/CVE-2024-48224.htmlWed, 17 Jun 2026 07:58:18 +0000MEDIUM 4.9: Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.https://patchthecve.com/cve/CVE-2024-48223.htmlhttps://patchthecve.com/cve/CVE-2024-48223.htmlWed, 17 Jun 2026 07:58:18 +0000HIGH 7.2: Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.https://patchthecve.com/cve/CVE-2024-48222.htmlhttps://patchthecve.com/cve/CVE-2024-48222.htmlWed, 17 Jun 2026 07:58:18 +0000HIGH 7.2: Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.https://patchthecve.com/cve/CVE-2024-48218.htmlhttps://patchthecve.com/cve/CVE-2024-48218.htmlWed, 17 Jun 2026 07:58:18 +0000HIGH 7.2: Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.https://patchthecve.com/cve/CVE-2024-48231.htmlhttps://patchthecve.com/cve/CVE-2024-48231.htmlWed, 17 Jun 2026 07:58:19 +0000HIGH 7.2: Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.