CVE-2026-2897

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2897
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2897.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2897
Aliases
Published
2026-02-22T00:02:08.938Z
Modified
2026-07-08T08:07:00.080700442Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
funadmin Backend index.html cross site scripting
Details

A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html of the component Backend Interface. The manipulation of the argument Value leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2897.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.1.0-rc1"
                },
                {
                    "last_affected": "7.1.0-rc1"
                },
                {
                    "introduced": "7.1.0-rc2"
                },
                {
                    "last_affected": "7.1.0-rc2"
                },
                {
                    "introduced": "7.1.0-rc3"
                },
                {
                    "last_affected": "7.1.0-rc3"
                },
                {
                    "introduced": "7.1.0-rc4"
                },
                {
                    "last_affected": "7.1.0-rc4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/funadmin/funadmin

Affected ranges

Type
GIT
Repo
https://github.com/funadmin/funadmin
Events
Introduced
64f7db23d3a87986978f0b46d65cb9ab756d33bb
Last affected
4bcda339edc68000f77b42d418a171e90c640949
Database specific 
{
    "cpe": [
        "cpe:2.3:a:funadmin:funadmin:7.1.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:funadmin:funadmin:7.1.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:funadmin:funadmin:7.1.0:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:funadmin:funadmin:7.1.0:rc4:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "7.1.0-rc1"
        },
        {
            "last_affected": "7.1.0-rc1"
        },
        {
            "introduced": "7.1.0-rc2"
        },
        {
            "last_affected": "7.1.0-rc2"
        },
        {
            "introduced": "7.1.0-rc3"
        },
        {
            "last_affected": "7.1.0-rc3"
        },
        {
            "introduced": "7.1.0-rc4"
        },
        {
            "last_affected": "7.1.0-rc4"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

7.*
7.1.0-rc1
7.1.0-rc2
7.1.0-rc3
7.1.0-rc4
v7.*
v7.1.0-rc1
v7.1.0-rc2
v7.1.0-rc3
v7.1.0-rc4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2897.json"