medium6.1
CVE-2024-48228
Funadmin Cross-site Scripting vulnerability
Impact
An issue was found in funadmin 5.0.2. The selectfiles method in `\backend\controller\sys\Attachh.php` directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting (XSS).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | funadmin/funadmin | <= 5.0.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Funadmin | Funadmin | Version 5.0.2 |