Fastadmin

CVE-2026-86244 Sep 07, 01:30 LOW POC PATCH Monitor

Cross-site scripting in FastAdmin's User Controller (versions up to 1.2.0.20210401_beta) allows remote unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious `url` redirect parameter on the login or register endpoint. The commit diff confirms the `$url` variable was echoed unescaped into HTML attribute contexts and a JavaScript `location.href` assignment in three template files, enabling `javascript:` URI injection in addition to classic reflected XSS. A public proof-of-concept exploit exists; the vendor-released patch in version 1.2.1.20210731_beta resolves all three injection points.

CVE-2025-14966 Dec 19, 20:15 LOW POC Monitor

SQL injection in FastAdmin up to version 1.7.0.20250506 allows high-privilege authenticated attackers to execute arbitrary SQL queries via manipulation of the custom/searchField parameter in the selectpage function of the Backend Controller. The vulnerability requires administrator-level privileges and has publicly available exploit code, though the low CVSS score (2.0) and minimal EPSS exploitation probability (0.06%) indicate limited real-world risk despite active disclosure.

CVE-2024-7928 Aug 19, 22:15 MEDIUM POC THREAT This Month

A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-7453 Aug 04, 05:16 MEDIUM POC This Month

A vulnerability was found in FastAdmin 1.5.0.20240328. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-43117 Dec 13, 12:15 CRITICAL POC Act Now

fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-25967 Dec 10, 23:15 HIGH POC This Week

The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-21665 Nov 17, 15:15 HIGH PATCH This Week

In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

CVE-2019-17432 Oct 10, 12:15 MEDIUM POC This Month

An issue was discovered in fastadmin 1.0.0.20190705_beta. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-17431 Oct 10, 12:15 HIGH POC This Week

An issue was discovered in fastadmin 1.0.0.20190705_beta. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-11077 Apr 11, 02:29 HIGH POC This Week

FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-10268 Apr 22, 01:29 MEDIUM POC This Month

An issue was discovered in FastAdmin V1.0.0.20180417_beta. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.