ZeroDay Findings
Sign inSign up

Findings

CVE-2026-2895

A security flaw has been discovered in funadmin up to 7.1.0-rc4.

Published Feb 21, 2026 · updated Jun 17, 2026 · funadmin funadmin

A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 21, 2026 · NIST NVD

    Detected

    A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit

  2. Jun 17, 2026 · NIST NVD

    Updated

    A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit

Affected

  • cpe funadmin/funadminversion unspecified
  • cpe funadmin/funadmin7.1.0

Sources

  • NIST NVDVulnerability recordCVE-2026-2895

    A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of t

    nvd.nist.gov

References

CVE-2026-2895 · ZeroDay Findings