CVE-2026-2895

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2895", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-20T18:56:43.277Z", "datePublished": "2026-02-21T23:02:11.258Z", "dateUpdated": "2026-02-23T19:27:18.883Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-21T23:02:11.258Z"}, "title": "funadmin Member.php repass password recovery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-640", "lang": "en", "description": "Weak Password Recovery"}]}], "affected": [{"vendor": "n/a", "product": "funadmin", "versions": [{"version": "7.1.0-rc1", "status": "affected"}, {"version": "7.1.0-rc2", "status": "affected"}, {"version": "7.1.0-rc3", "status": "affected"}, {"version": "7.1.0-rc4", "status": "affected"}], "cpes": ["cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-20T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-20T20:02:00.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "I4m6da (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347206", "name": "VDB-347206 | funadmin Member.php repass password recovery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347206", "name": "VDB-347206 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753971", "name": "Submit #753971 | funadmin v7.1.0-rc4 CWE-640: Weak Password Recovery Mechanism for Forgotten Password", "tags": ["third-party-advisory"]}, {"url": "https://github.com/I4m6da/CVE/issues/2", "tags": ["issue-tracking"]}, {"url": "https://github.com/I4m6da/CVE/issues/2#issue-3884919985", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T19:26:56.421604Z", "id": "CVE-2026-2895", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:27:18.883Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2895", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T19:26:56.421604Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:27:07.887Z"}}], "cna": {"title": "funadmin Member.php repass password recovery", "credits": [{"lang": "en", "type": "reporter", "value": "I4m6da (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*"], "vendor": "n/a", "product": "funadmin", "versions": [{"status": "affected", "version": "7.1.0-rc1"}, {"status": "affected", "version": "7.1.0-rc2"}, {"status": "affected", "version": "7.1.0-rc3"}, {"status": "affected", "version": "7.1.0-rc4"}]}], "timeline": [{"lang": "en", "time": "2026-02-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-20T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-20T20:02:00.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347206", "name": "VDB-347206 | funadmin Member.php repass password recovery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347206", "name": "VDB-347206 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753971", "name": "Submit #753971 | funadmin v7.1.0-rc4 CWE-640: Weak Password Recovery Mechanism for Forgotten Password", "tags": ["third-party-advisory"]}, {"url": "https://github.com/I4m6da/CVE/issues/2", "tags": ["issue-tracking"]}, {"url": "https://github.com/I4m6da/CVE/issues/2#issue-3884919985", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "Weak Password Recovery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-21T23:02:11.258Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2895", "state": "PUBLISHED", "dateUpdated": "2026-02-23T19:27:18.883Z", "dateReserved": "2026-02-20T18:56:43.277Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-21T23:02:11.258Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*"], "product": "funadmin", "vendor": "n/a", "versions": [{"status": "affected", "version": "7.1.0-rc1"}, {"status": "affected", "version": "7.1.0-rc2"}, {"status": "affected", "version": "7.1.0-rc3"}, {"status": "affected", "version": "7.1.0-rc4"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*", "matchCriteriaId": "67A1D507-8F8E-4C10-B5CB-D08DE081AF77", "versionEndExcluding": "7.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:funadmin:funadmin:7.1.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "D14B5D13-CC64-43DE-A709-150D9284D19C", "vulnerable": true}, {"criteria": "cpe:2.3:a:funadmin:funadmin:7.1.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "2BF7A984-32FB-4957-8151-47FC4C2CB9CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:funadmin:funadmin:7.1.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "518EE1E1-CD85-4784-94E5-D7DF735BFF56", "vulnerable": true}, {"criteria": "cpe:2.3:a:funadmin:funadmin:7.1.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "303D805A-EEC2-44FE-BB54-8B336EA8A3E7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha descubierto una falla de seguridad en funadmin hasta 7.1.0-rc4. La cual afecta a la funci\u00f3n repass del archivo app/frontend/controller/Member.PHP. Manipular el argumento forget_code/vercode provoca una recuperaci\u00f3n de contrase\u00f1a d\u00e9bil. Es posible explotar el ataque en remoto. El ataque est\u00e1 calificado de complejidad alta y se sabe que es dif\u00edcil de explotar. El exploit ha sido publicado y puede ser utilizado para ataques. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2895", "lastModified": "2026-06-17T10:31:59.270", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2895", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T19:26:56.421604Z", "version": "2.0.3"}}]}, "published": "2026-02-21T23:15:59.990", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/I4m6da/CVE/issues/2"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/I4m6da/CVE/issues/2#issue-3884919985"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.347206"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.347206"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.753971"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-640"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0-rc1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0-rc2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0-rc3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0-rc4"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "funadmin", "source": "cna", "vendor": "n/a"}, "product": "funadmin", "vendor": "funadmin"}], "analysis": {"en": {"generated_at": "2026-04-18T11:15:41.665700+00:00", "value": {"mitigation_remediation": ["Upgrade funadmin to a version newer than 7.1.0\u2011rc4 to remove the vulnerable repass implementation.", "Restrict access to the password recovery endpoint by enforcing stricter authorization checks, such as requiring authenticated sessions or secondary verification steps before allowing password resets.", "Implement temporary hardening by disabling the vulnerable feature or adding custom token validation logic to ensure that only legitimate recovery requests are processed, thereby mitigating the risk until an official patch is applied."], "summary": {"action": "Apply Fix", "impact": "Account Compromise"}, "threat_synthesis": {"affected_systems": "All installations of funadmin up to and including version 7.1.0\u2011rc4 are affected, as the flaw exists within the repass routine of app/frontend/controller/Member.php. The vulnerability applies regardless of the operating environment because no platform constraints are specified, meaning every deployed instance of funadmin lacking an update could be vulnerable.", "description_and_impact": "The vulnerability resides in funadmin\u2019s Member.php repass function, where manipulation of the forget_code or vercode arguments allows an attacker to trigger weak password recovery. This flaw can bypass proper verification, potentially giving an attacker the ability to reset or retrieve a user\u2019s password. Categorized as CWE\u2011640 due to inadequate authorization checks, a successful exploit would enable unauthorized access to accounts, leading to confidentiality loss and possible privilege escalation.", "risk_and_exploitability": "The CVSS score of 6.3 signals moderate severity, but the need for high attack complexity and the difficulty of exploitation lower the immediate threat. The EPSS score of less than 1% indicates that, as of now, the probability of widespread attacks is low. However, the exploit has been made publicly available and is not listed in the KEV catalog, meaning that determined attackers could still target exposed systems remotely by crafting malicious requests to the password recovery endpoint."}}}}, "created": "2026-02-23T14:29:53.799690+00:00", "updated": "2026-04-18T11:30:44.303745+00:00", "vendors": ["funadmin", "funadmin$PRODUCT$funadmin"]}