CVE-2026-102247
MediumCVSS 6.8Summary
A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602 in the file application/database.php of the Database Management component. Manipulation leads to execution with unnecessary privileges. The attack can be launched remotely, and the exploit is public.
Risk Assessment
The organization is exposed to remote takeover with elevated privileges, potentially leading to data confidentiality and integrity breaches.
Recommendation
Apply available patches or update FastAdmin to the latest version. Restrict access to the admin panel and monitor logs for suspicious activity.
Other vulnerabilities in FastAdmin
See all- CVE-2026-51775Critical
SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to execute arbitrary code via the application/common/controller/Backend.php component.
- CVE-2026-86244Medium
A security vulnerability was detected in FastAdmin up to 1.2.0.20210401_beta. The affected function is register/login in the file application/index/controller/User.php (User Controller component). Manipulation of the url argument leads to cross-site scripting. The attack may be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 1.2.1.20210731_beta addresses this issue.
Original NVD description (English source)
A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component Database Management. The manipulation results in execution with unnecessary privileges. The attack may be launched remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS