An unauthenticated attacker can inject arbitrary JavaScript into the backend index page by manipulating the unvalidated "Value" argument delivered to app/backend/view/index/index.html. The malicious payload will execute in the browser of any user who visits the page, allowing the attacker to steal session cookies, deface the interface, or redirect users to phishing sites. This is a classic client‑side XSS (CWE‑79) vulnerability; no evidence of server‑side code execution is provided.

The flaw is present in all releases of funadmin up to and including 7.1.0‑rc4, as listed in the vendor’s CPE entries. Earlier releases may also be affected but are not explicitly mentioned in the advisory.

The CVSS base score of 4.8 indicates moderate severity, while the EPSS score of less than 1 % shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, suggesting no known in‑the‑wild exploitation. The attack can be carried out remotely through the backend interface, and requires only access to the vulnerable URL; therefore, network‑level controls can help mitigate risk.