Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module

Admidio is a free, open source user management system for websites of organizations and groups

Admidio is a free, open source user management system for websites of organizations and groups

Admidio is a free, open source user management system for websites of organizations and groups

Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest

Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed

Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders

Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)

Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9

Admidio before 5.0.12 Authentication Bypass via RSS feeds

Admidio before 5.0.12 SQL Injection via relation_type_list

Admidio before 5.0.11 Authentication Bypass via forum.php

Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess

SQL Injection was discovered in Admidio before version 3.3.13

Admidio: Missing CSRF Protection on Registration Approval Actions

Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10

SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5

Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9

Incomplete fix for CVE-2026-32812: SSRF in admidio

Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation

Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php

Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php

Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`

Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges

Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint

Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items

Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials

Admidio is Missing Authorization on Forum Topic and Post Deletion

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11

Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS)

Admidio is a free open source user management system for websites of organizations and groups

Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions

Admidio is Missing CSRF Protection on Role Membership Date Changes

Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter

Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9

Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8

Admidio 4.1.2 version is affected by stored cross-site scripting (XSS)

Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed