SQL Injection Vulnerability in FunAdmin from 苏州泛爱软件科技有限公司
CVE-2026-121610

6.9MEDIUM

Key Information:

Vendor: 苏州泛爱软件科技有限公司
Status: Funadmin
Vendor: CVE Published:; 4 November 2026

🔔 Create 苏州泛爱软件科技有限公司 Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-121610?

A security flaw has been identified in FunAdmin version 7.1.0, specifically in the Curd::selectList function located in the /frontend/ajax/index file of the Frontend List Endpoint. This vulnerability allows an attacker to manipulate the selectFields argument, resulting in a potential SQL injection. The exploit can be executed remotely, increasing the risk of unauthorized data access. Despite early notification, the vendor has not responded to the report of this vulnerability, leaving users at risk. It is recommended that users of FunAdmin 7.1.0 take immediate action to secure their systems against possible exploitation.

Affected Version(s)

funadmin 7.1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-121610 - Proof of Concept