PT-2026-21398

CVE-2026-2894

Published

2026-02-21

Updated

2026-02-24

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions funadmin versions up to 7.1.0-rc4

Description A flaw exists in funadmin that could allow information disclosure. This issue is related to the getMember function within the app/frontend/view/login/forget.html file. The attack can be initiated remotely. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

I4M6Da

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-284: Improper Access Control

Related identifiers