CVE-2026-121610: funadmin Frontend List Endpoint index selectList sql injection
A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Does exploitation require an account or user interaction?
No. The vulnerability is remotely exploitable over the network, and the supplied vector indicates that it requires neither privileges nor user interaction.
How likely is active exploitation?
A public exploit has been released, so attackers may be able to use it directly against reachable affected endpoints.
Which release is identified as affected?
The reported affected release is funadmin 7.1.0.