funadmin frontend list endpoint SQL injection

funadmin, a website admin tool, lets strangers read or change its database.

Summary

A flaw in the frontend list endpoint of funadmin 7.1.0 lets a remote attacker inject SQL through the selectFields argument. A public exploit has been released, and the vendor did not respond.

What to do

We have not confirmed a fixed version yet. Check the source links below.

Products and platforms

funadmin

CVE IDs

CVE-2026-121610 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 02:00 UTC

First seen 2026-11-09 15:20 UTC