Admidio vulnerabilities

Products

• Admidio 73
• Admidio/admidio 7

Newest

• admidio Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php CVE-2026-117554 5.3 MediumOctober 27, 2026
• admidio Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed CVE-2026-111916 6.9 MediumOctober 17, 2026
• admidio Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php CVE-2026-111914 7.1 HighOctober 17, 2026
• admidio Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php CVE-2026-111913 5.3 MediumOctober 17, 2026
• admidio Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update CVE-2026-111912 7.1 HighOctober 17, 2026
• admidio Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php CVE-2026-109329 8.5 HighOctober 12, 2026
• admidio Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name CVE-2026-109328 5.3 MediumOctober 12, 2026
• admidio Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php CVE-2026-109327 5.1 MediumOctober 12, 2026
• admidio Admidio before 5.0.12 Broken Access Control via profile_function.php CVE-2026-82658 5.3 MediumAugust 30, 2026
• admidio Admidio before 5.0.12 Authentication Bypass via RSS feeds CVE-2026-82657 8.7 HighAugust 30, 2026
• admidio Admidio before 5.0.12 Path Traversal via Photo ZIP Download CVE-2026-82656 2.1 LowAugust 30, 2026
• admidio Admidio before 5.0.12 SQL Injection via relation_type_list CVE-2026-82655 8.7 HighAugust 30, 2026
• admidio Admidio before 5.0.11 IDOR via save_temporary mylist_function.php CVE-2026-69094 5.3 MediumAugust 3, 2026
• admidio Admidio before 5.0.11 CSRF via category-report preferences CVE-2026-69093 7.1 HighAugust 3, 2026
• admidio Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint CVE-2026-69092 6.9 MediumAugust 3, 2026
• admidio Admidio before 5.0.11 Authentication Bypass via forum.php CVE-2026-69091 8.7 HighAugust 3, 2026
• admidio Admidio before 5.0.11 Cross-Organization Role Modification CVE-2026-69090 6.9 MediumAugust 3, 2026
• admidio Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests CVE-2026-53760 5.2 MediumJuly 9, 2026
• admidio Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 CVE-2026-47233 Fix available 6.5 MediumMay 29, 2026
• admidio Admidio writes session IDs and auto-login cookie values to application logs CVE-2026-47234 Fix available 4.4 MediumMay 29, 2026
• admidio Admidio PKCS#12 private key export action lacks CSRF protection CVE-2026-47232 Fix available 4.3 MediumMay 29, 2026
• admidio Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders CVE-2026-47231 Fix available 8.1 HighMay 29, 2026
• admidio Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders CVE-2026-47230 Fix available 6.5 MediumMay 29, 2026
• admidio Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation CVE-2026-47229 Fix available 5.4 MediumMay 29, 2026
• admidio Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords CVE-2026-47228 Fix available 5.2 MediumMay 29, 2026
• admidio Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php` CVE-2026-47227 Fix available 6.5 MediumMay 29, 2026
• admidio Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges CVE-2026-47226 Fix available 6.5 MediumMay 29, 2026
• admidio Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php CVE-2018-25370 6.9 MediumMay 25, 2026
• admidio Incomplete fix for CVE-2026-32812: SSRF in admidio CVE-2026-42194 Fix available 6.8 MediumMay 5, 2026
• admidio Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation CVE-2026-41671 Fix available 6.8 MediumApril 29, 2026
• admidio Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest CVE-2026-41670 Fix available 8.2 HighApril 29, 2026
• admidio Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CVE-2026-41669 Fix available 8.2 HighApril 29, 2026
• admidio Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send CVE-2026-41663 Fix available 3.5 LowApril 29, 2026
• admidio Admidio: Missing Minimum Administrator Check in Role Membership Removal CVE-2026-41662 Fix available 5.2 MediumApril 29, 2026
• admidio Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion CVE-2026-41661 Fix available 6.1 MediumApril 29, 2026
• admidio Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP CVE-2026-41660 Fix available 7.1 HighApril 29, 2026
• admidio Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment CVE-2026-41659 Fix available 2.7 LowApril 29, 2026
• admidio Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items CVE-2026-41658 Fix available 6.5 MediumApril 29, 2026
• admidio Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php CVE-2026-41657 Fix available 4.9 MediumApril 29, 2026
• admidio Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read CVE-2026-41656 Fix available 4.5 MediumApril 29, 2026
• admidio Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials CVE-2026-41655 Fix available 6.5 MediumApril 29, 2026
• admidio Admidio: Missing CSRF Protection on Registration Approval Actions CVE-2026-34384 Fix available 4.5 MediumMarch 31, 2026
• admidio Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter CVE-2026-34383 Fix available 4.3 MediumMarch 31, 2026
• admidio Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php CVE-2026-34382 Fix available 4.6 MediumMarch 31, 2026
• admidio Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess CVE-2026-34381 Fix available 7.5 HighMarch 31, 2026
• admidio Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter) CVE-2026-32813 Fix available 8.0 HighMarch 16, 2026
• admidio Admidio is Missing Authorization on Forum Topic and Post Deletion CVE-2026-32818 Fix available 6.5 MediumMarch 16, 2026
• admidio Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection CVE-2026-32757 Fix available 5.4 MediumMarch 16, 2026
• admidio Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVE-2026-32817 Fix available 9.1 CriticalMarch 16, 2026
• admidio Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint CVE-2026-32812 Fix available 6.8 MediumMarch 16, 2026
• Show olderLoading…