Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php

Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords

Admidio: Missing Minimum Administrator Check in Role Membership Removal

Admidio before 5.0.11 Cross-Organization Role Modification

Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php

Admidio before 5.0.11 CSRF via category-report preferences

Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php

Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read

admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts

Admidio writes session IDs and auto-login cookie values to application logs

Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php

Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php

Admidio before 5.0.12 Broken Access Control via profile_function.php

Admidio PKCS#12 private key export action lacks CSRF protection

Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Admidio vulnerable to HTML Injection In The Messages Section

Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send

Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter

Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9

Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment

Admidio before 5.0.12 Path Traversal via Photo ZIP Download

Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a