Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Sep 29, 2026A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602.CVE-2026-102247 · Other software · reported by VulDBHigh 7.1
A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component Database Management. The manipulation results in execution with unnecessary privileges. The attack may be launched remotely. The exploit is now public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta.CVE-2026-86244 · Other software · reported by VulDBLow 2.1
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlhzzz08.github.io
Aug 3, 2026SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php componeCVE-2026-51775 · Other software · reported by MITRECritical 9.8
SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025A vulnerability was determined in FastAdmin up to 1.7.0.20250506.CVE-2025-14966 · Other software · Fastadmin · reported by VulDBLow 2
A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controller/Backend.php of the component Backend Controller. Executing a manipulation of the argument custom/searchField can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comnote-hxlab.wetolink.com
Aug 19, 2024A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121.CVE-2024-7928 · Other software · fastadmin · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.4.20220530 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2024A vulnerability was found in FastAdmin 1.5.0.20240328.CVE-2024-7453 · Other software · fastadmin · reported by VulDBMedium 5.1
A vulnerability was found in FastAdmin 1.5.0.20240328. It has been declared as problematic. This vulnerability affects unknown code of the file /[admins_url].php/general/attachment/edit/ids/4?dialog=1 of the component Attachment Management Section. The manipulation of the argument row[url]/row[imagewidth]/row[imageheight] leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273544.
- Product
- fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.CVE-2021-43117 · Other software · Fastadmin · reported by MITRECritical 9.8
fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2021fastadmin V1.0.0.20200506_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtain administrator credentials to log in to CVE-2020-26609 · Other software · Fastadmin · reported by MITREMedium 5.4
fastadmin V1.0.0.20200506_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtain administrator credentials to log in to the background.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability.CVE-2020-25967 · Other software · Fastadmin · reported by MITREHigh 8.8
The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnpanda.netcnpanda.net
Nov 17, 2020In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajaxCVE-2020-21665 · Other software · Fastadmin · reported by MITREHigh 7.2
In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2020In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injCVE-2020-21667 · Other software · Fastadmin-tp6 Project · reported by MITREHigh 7.2
In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection.
- Product
- Fastadmin-tp6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2019An issue was discovered in fastadmin 1.0.0.20190705_beta.CVE-2019-17432 · Other software · Fastadmin · reported by MITREMedium 6.5
An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/admin/general.config/edit CSRF vulnerability, as demonstrated by resultant XSS via the row[name] parameter.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2019An issue was discovered in fastadmin 1.0.0.20190705_beta.CVE-2019-17431 · Other software · Fastadmin · reported by MITREHigh 8.8
An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2019FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI.CVE-2019-11077 · Other software · Fastadmin · reported by MITREHigh 8.8
FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Apr 21, 2018An issue was discovered in FastAdmin V1.0.0.20180417_beta.CVE-2018-10268 · Other software · Fastadmin · reported by MITREMedium 5.4
An issue was discovered in FastAdmin V1.0.0.20180417_beta. There is XSS via the application\api\controller\User.php avatar parameter.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.