GHSA-fmr2-m7gc-577w

Suggest an improvement
Source
https://github.com/advisories/GHSA-fmr2-m7gc-577w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fmr2-m7gc-577w/GHSA-fmr2-m7gc-577w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fmr2-m7gc-577w
Aliases
Published
2026-02-22T00:31:01Z
Modified
2026-02-26T15:56:18Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
funadmin has Weak Password Recovery Mechanism for Forgotten Password
Details

A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "cwe_ids":  [
        "CWE-640"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-26T15:31:41Z",
    "nvd_published_at":  "2026-02-21T23:15:59Z",
    "severity":  "LOW"
}
References

Affected packages

Packagist / funadmin/funadmin

Package

Name
funadmin/funadmin
Purl
pkg:composer/funadmin/funadmin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
7.1.0-rc4

Affected versions

v1.*
v1.1
v1.02
v1.5.0
v2.*
v2.1.0
v2.2
v2.2.6
v2.2.9
v2.2.10
v2.2.11
v2.2.12
v2.2.13
v2.2.14
v2.3
v2.3.1
v2.4.0
v2.4.1
v2.4.2
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v3.*
v3.0
v3.0.1
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.7
v7.*
v7.0.0_rc1
v7.0.0_rc2
v7.0.0_rc3
v7.0.0_rc4
v7.0.0_rc5
v7.0.0_rc6
v7.0.0_rc6.1
v7.0.0_rc6.2
v7.0.0_rc6.3
v7.0.0_rc7
v7.0.0_rc7.1
v7.0.0_rc8.0
v7.0.0_rc8.1
v7.0.0_rc8.1.1
v7.0.0
v7.0.1
v7.0.2
v7.1.0-rc1
v7.1.0-rc2
v7.1.0-rc3
v7.1.0-rc4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fmr2-m7gc-577w/GHSA-fmr2-m7gc-577w.json"