CVE-2026-2897

The record

A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html of the component Backend Interface. The manipulation of the argument Value leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Related vulnerabilities

• GHSA-rfh7-7v27-6p9r funadmin: XSS through Value argument in Backend Interface component Same vulnerability
• GHSA-gcxp-xg77-798j funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService… Also affects funadmin/funadmin
• CVE-2026-2898 A vulnerability was detected in funadmin up to 7.1.0-rc4. Also affects funadmin/funadmin
• GHSA-5m2g-4cf6-c3rg funadmin has Incorrect Privilege Assignment in its Configuration Handler Also affects funadmin/funadmin
• GHSA-8hhx-xq9j-xwfj funadmin exposes sensitive information via getMember function Also affects funadmin/funadmin
• GHSA-fmr2-m7gc-577w funadmin has Weak Password Recovery Mechanism for Forgotten Password Also affects funadmin/funadmin
• CVE-2026-2896 A weakness has been identified in funadmin up to 7.1.0-rc4. Also affects funadmin/funadmin
• CVE-2026-2894 A vulnerability was identified in funadmin up to 7.1.0-rc4. Also affects funadmin/funadmin