CVE-2026-121610

validated

GHSA-xwpx-frq4-pw9h ↗EUVD-2026-116691 ↗

check availablenot proven exploitable

cve.orgpublic pockev

funadmin 7.1.0

ETK-2026-3446, permanent identifier

cvss7.3cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

+2h52mTTV

43mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0hcheck available+2h52magent stopped

+1h

+2h

description

funadmin 7.1.0 is affected by SQL injection in the Frontend List Endpoint. A remote attacker may influence database queries through the selectFields input when they can reach that endpoint; the supplied scoring data indicates no authentication is required.

mitigation

Restrict network access to the Frontend List Endpoint and reject or strictly allowlist selectFields values at any intervening control. Monitor vendor channels for a corrected funadmin release; the supplied evidence does not identify a fixed version.

check

available

exploit

automation

deterministic

auth required

EPSS

–

agent run time

43m

cve.org record, t = 0

2026-11-04 02:00Z

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-04 02:00Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-xwpx-frq4-pw9h
2026-11-04 02:00Z
cve.org record for CVE-2026-121610
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-121610

this entry in the feed

GET /api/v1/feed/CVE-2026-121610

{
  "etk_id": "ETK-2026-3446",
  "cve_id": "CVE-2026-121610",
  "display_id": "CVE-2026-121610",
  "ghsa_id": "GHSA-xwpx-frq4-pw9h",
  "euvd_id": "EUVD-2026-116691",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in funadmin Frontend List Endpoint",
  "summary": "funadmin 7.1.0 is affected by SQL injection in the Frontend List Endpoint. A remote attacker may influence database queries through the selectFields input when they can reach that endpoint; the supplied scoring data indicates no authentication is required.",
  "mitigation": "Restrict network access to the Frontend List Endpoint and reject or strictly allowlist selectFields values at any intervening control. Monitor vendor channels for a corrected funadmin release; the supplied evidence does not identify a fixed version.",
  "vendor": null,
  "product": "funadmin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "7.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "funadmin",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 43.03083386666667,
  "t0_at": "2026-11-04T02:00:20.150000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-04T04:52:49.082623+00:00",
      "days": 0.11977931276620371,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T02:00:20.150000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T02:00:20.150000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T02:00:20.150000+00:00",
      "url": "https://github.com/advisories/GHSA-xwpx-frq4-pw9h"
    }
  }
}

published 2026-11-04 04:09Z
last change 2026-11-04 04:52Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.