GitHub Advisoryadvisory · Packagist

GHSA-rfh7-7v27-6p9r funadmin: XSS through Value argument in Backend Interface component

LOW Published 2026-02-22 Modified 2026-02-26 Official page ↗
Aliases
CVE-2026-2897
Ecosystem
Packagist
Packages
funadmin/funadmin
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-02-26

Affected packages

• Packagist funadmin/funadmin: <= 7.1.0-rc4 (no fix yet)

Description

A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html of the component Backend Interface. The manipulation of the argument Value leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-2897 A security vulnerability has been detected in funadmin up to 7.1.0-rc4. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References