CVE-2026-2898

This vulnerability allows an attacker to inject malicious scripts into the backend interface of the funadmin application, potentially compromising user data or session information. It can be exploited remotely without needing special access, making it a significant risk for users running affected versions up to 7.1.0-rc4.

An attacker can remotely manipulate the configuration settings of the funadmin software, potentially allowing them to gain unauthorized access to sensitive features or data. This vulnerability affects versions up to 7.1.0-rc4, and it has been publicly disclosed, meaning that anyone can exploit it if they know how.

An attacker can exploit a weakness in the password recovery process of funadmin to potentially reset user passwords and gain unauthorized access to accounts. This requires the attacker to manipulate specific recovery codes, and while the method is complex and difficult, public information about the exploit is now available, increasing the risk of attacks.

This vulnerability allows an attacker to remotely access sensitive information from the funadmin application, specifically through a function related to password recovery. The issue affects versions up to 7.1.0-rc4, and there is already a publicly available exploit that could be used to take advantage of this flaw.