Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/50295?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50295?format=api", "vulnerability_id": "VCID-14y6-675h-rfex", "summary": "funadmin has Incorrect Privilege Assignment in its Configuration Handler\nA weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Configuration Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "aliases": [ { "alias": "CVE-2026-2896" }, { "alias": "GHSA-5m2g-4cf6-c3rg" } ], "fixed_packages": [], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74186?format=api", "purl": "pkg:composer/funadmin/funadmin@7.1.0-rc4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14y6-675h-rfex" }, { "vulnerability": "VCID-6ex5-r7ck-nkgu" }, { "vulnerability": "VCID-b9k4-kuhe-sug9" }, { "vulnerability": "VCID-bhzu-quhs-c3dh" }, { "vulnerability": "VCID-h19b-rapd-zyda" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/funadmin/funadmin@7.1.0-rc4" } ], "references": [ { "reference_url": "https://github.com/funadmin/funadmin", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/funadmin/funadmin" }, { "reference_url": "https://github.com/I4m6da/CVE/issues/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/I4m6da/CVE/issues/3" }, { "reference_url": "https://vuldb.com/?ctiid.347207", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://vuldb.com/?ctiid.347207" }, { "reference_url": "https://vuldb.com/?id.347207", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://vuldb.com/?id.347207" }, { "reference_url": "https://vuldb.com/?submit.753972", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://vuldb.com/?submit.753972" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2896", "reference_id": "CVE-2026-2896", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2896" }, { "reference_url": "https://github.com/advisories/GHSA-5m2g-4cf6-c3rg", "reference_id": "GHSA-5m2g-4cf6-c3rg", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-5m2g-4cf6-c3rg" } ], "weaknesses": [ { "cwe_id": 266, "name": "Incorrect Privilege Assignment", "description": "A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": "4.0 - 7.3", "exploitability": "0.5", "weighted_severity": "6.6", "risk_score": 3.3, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-14y6-675h-rfex" }