CVE-2026-2897

An attacker can remotely exploit a vulnerability in funadmin to manipulate user account data, potentially allowing them to execute harmful code on the server. This issue affects versions up to 7.1.0-rc4 and arises from improper handling of input in the authentication service.

An attacker can remotely manipulate the configuration settings of the funadmin software, potentially allowing them to gain unauthorized access to sensitive features or data. This vulnerability affects versions up to 7.1.0-rc4, and it has been publicly disclosed, meaning that anyone can exploit it if they know how.

An attacker can exploit a weakness in the password recovery process of funadmin to potentially reset user passwords and gain unauthorized access to accounts. This requires the attacker to manipulate specific recovery codes, and while the method is complex and difficult, public information about the exploit is now available, increasing the risk of attacks.

This vulnerability allows an attacker to remotely access sensitive information from the funadmin application, specifically through a function related to password recovery. The issue affects versions up to 7.1.0-rc4, and there is already a publicly available exploit that could be used to take advantage of this flaw.