CVE-2024-48228

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-48228
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48228.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-48228
Aliases
Published
2024-10-25T00:00:00Z
Modified
2026-07-15T01:49:09.590376345Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting (XSS).

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48228.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/funadmin/funadmin

Affected ranges

Type
GIT
Repo
https://github.com/funadmin/funadmin
Events
Introduced
427a2911398489110a5e64841b66db700283bc55
Last affected
427a2911398489110a5e64841b66db700283bc55
Database specific 
{
    "cpe": "cpe:2.3:a:funadmin:funadmin:5.0.2:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "5.0.2"
        },
        {
            "last_affected": "5.0.2"
        }
    ]
}

Affected versions

5.*
5.0.2
v5.*
v5.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48228.json"