Threats affecting pkg:github/funadmin

A SQL injection vulnerability exists in funadmin version 7.1.0 in the Curd::selectList function within the /frontend/ajax/index file of the Frontend List Endpoint component. The flaw allows remote attackers to manipulate the selectFields argument to execute SQL injection attacks. Public exploit code has been released, and the vendor has not responded to disclosure attempts.