CVE-2026-2894

An attacker can remotely exploit a vulnerability in funadmin to manipulate user account data, potentially allowing them to execute harmful code on the server. This issue affects versions up to 7.1.0-rc4 and arises from improper handling of input in the authentication service.

This vulnerability allows an attacker to inject malicious scripts into the backend interface of the funadmin application, potentially compromising user data or session information. It can be exploited remotely without needing special access, making it a significant risk for users running affected versions up to 7.1.0-rc4.

An attacker can remotely manipulate the configuration settings of the funadmin software, potentially allowing them to gain unauthorized access to sensitive features or data. This vulnerability affects versions up to 7.1.0-rc4, and it has been publicly disclosed, meaning that anyone can exploit it if they know how.

An attacker can exploit a weakness in the password recovery process of funadmin to potentially reset user passwords and gain unauthorized access to accounts. This requires the attacker to manipulate specific recovery codes, and while the method is complex and difficult, public information about the exploit is now available, increasing the risk of attacks.