A vulnerability was found in funadmin up to 7.1.0-rc4. It has been classified as problematic. Affected by this issue is the function
repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery.
This vulnerability is known as CVE-2026-2895. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
