Live › vulnerability › CVE-2026-121610
funadmin 7.1.0 has a SQL injection in Curd::selectList behind the frontend ajax index endpoint: the selectFields argument reaches a query unchecked. The CVE record says an exploit is public and the vendor did not respond; no fix is known. Whether the endpoint is reachable without login is not stated in the sources I could read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 02:46 UTC. All times on this page are UTC.
Teams running funadmin 7.1.0 with the frontend ajax endpoint reachable from the internet are exposed. The sources do not say whether the endpoint is on by default. Installations that do not expose that frontend path are unlikely to be reachable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| funadmin/funadmin | composer | 7.1.0 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121610")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.