Login Request a demo
AD
Vendor
admidio
1 product with CVEs on record
73
CVEs
0
On KEV
8
New 30D
Products
AD
admidio
admidio
9.1
73 CVEs0 on KEV8 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-117554
New
AD
admidio
admidio
4.3–Oct 27Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
CVE-2026-111916
AD
admidio
Admidio
5.3
0%
Oct 17Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
CVE-2026-111914
AD
admidio
Admidio
6.5
0%
Oct 17Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
CVE-2026-111913
AD
admidio
Admidio
4.3
0%
Oct 17Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
CVE-2026-111912
AD
admidio
Admidio
6.5
0%
Oct 17Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
CVE-2026-109329
AD
admidio
Admidio
6.5
0%
Oct 12Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php
CVE-2026-109328
AD
admidio
Admidio
6.1
0%
Oct 12Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name
CVE-2026-109327
AD
admidio
Admidio
6.1
0%
Oct 12Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php
CVE-2026-53760
AD
admidio
Admidio
5.2
0%
Sep 4Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
CVE-2026-82658
AD
admidio
Admidio
4.3
0%
Aug 30Admidio before 5.0.12 Broken Access Control via profile_function.php
CVE-2026-82657
AD
admidio
Admidio
7.5
0%
Aug 30Admidio before 5.0.12 Authentication Bypass via RSS feeds
CVE-2026-82656
AD
admidio
Admidio
2.6
0%
Aug 30Admidio before 5.0.12 Path Traversal via Photo ZIP Download
CVE-2026-82655
AD
admidio
Admidio
7.5
1%
Aug 30Admidio before 5.0.12 SQL Injection via relation_type_list
CVE-2026-47234
AD
admidio
Admidio
4.4
0%
Aug 12Admidio writes session IDs and auto-login cookie values to application logs
CVE-2026-47233
AD
admidio
Admidio
6.5
0%
Aug 12Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
CVE-2026-47232
AD
admidio
Admidio
4.3
0%
Aug 12Admidio PKCS#12 private key export action lacks CSRF protection
CVE-2026-47231
AD
admidio
Admidio
8.1
0%
Aug 12Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
CVE-2026-47230
AD
admidio
Admidio
6.5
0%
Aug 12Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
CVE-2026-47229
AD
admidio
Admidio
5.4
0%
Aug 12Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
CVE-2026-47228
AD
admidio
Admidio
5.2
0%
Aug 12Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
CVE-2026-47227
AD
admidio
Admidio
6.5
0%
Aug 12Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
CVE-2026-47226
AD
admidio
Admidio
6.5
0%
Aug 12Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
CVE-2026-69094
AD
admidio
Admidio
4.3
0%
Aug 3Admidio before 5.0.11 IDOR via save_temporary mylist_function.php
CVE-2026-69093
AD
admidio
Admidio
4.6
0%
Aug 3Admidio before 5.0.11 CSRF via category-report preferences
CVE-2026-69092
AD
admidio
Admidio
6.5
0%
Aug 3Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint
CVE-2026-69091
AD
admidio
Admidio
7.5
1%
Aug 3Admidio before 5.0.11 Authentication Bypass via forum.php
CVE-2026-69090
AD
admidio
Admidio
4.9
0%
Aug 3Admidio before 5.0.11 Cross-Organization Role Modification
CVE-2018-25370
AD
Admidio
Admidio
5.3
0%
May 25Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php
CVE-2026-42194
AD
admidio
Admidio
6.8
0%
May 7Incomplete fix for CVE-2026-32812: SSRF in admidio
CVE-2026-41671
AD
admidio
Admidio
6.8
0%
May 7Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
CVE-2026-41670
AD
admidio
Admidio
8.2
0%
May 7Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest
CVE-2026-41669
AD
admidio
Admidio
8.2
0%
May 7Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed
CVE-2026-41663
AD
admidio
Admidio
3.5
0%
May 7Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send
CVE-2026-41662
AD
admidio
Admidio
5.2
0%
May 7Admidio: Missing Minimum Administrator Check in Role Membership Removal
CVE-2026-41661
AD
admidio
Admidio
6.1
0%
May 7Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
CVE-2026-41660
AD
admidio
Admidio
7.1
0%
May 7Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP
CVE-2026-41659
AD
admidio
Admidio
2.7
0%
May 7Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment
CVE-2026-41658
AD
admidio
Admidio
6.5
0%
May 7Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
CVE-2026-41657
AD
admidio
Admidio
4.9
0%
May 7Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php
CVE-2026-41656
AD
admidio
Admidio
4.5
0%
May 7Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read
CVE-2026-41655
AD
admidio
Admidio
6.5
0%
May 7Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials
CVE-2026-34384
AD
admidio
Admidio
7.3
0%
Mar 31Admidio: Missing CSRF Protection on Registration Approval Actions
CVE-2026-34383
AD
admidio
Admidio
3.5
0%
Mar 31Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter
CVE-2026-34382
AD
admidio
Admidio
4.6
0%
Mar 31Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php
CVE-2026-34381
AD
admidio
Admidio
7.5
1%
Mar 31Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
CVE-2026-32813
AD
admidio
Admidio
8.0
0%
Mar 20Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
CVE-2026-32817
AD
admidio
Admidio
9.1
0%
Mar 20Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
CVE-2026-32812
AD
admidio
Admidio
6.8
0%
Mar 20Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
CVE-2026-32757
AD
admidio
Admidio
5.4
0%
Mar 19Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
CVE-2026-32756
AD
admidio
Admidio
8.8
1%
Mar 19Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
CVE-2026-32818
AD
admidio
Admidio
6.5
0%
Mar 19Admidio is Missing Authorization on Forum Topic and Post Deletion
CVE-2026-32816
AD
admidio
Admidio
5.7
0%
Mar 19Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
CVE-2026-32755
AD
admidio
Admidio
5.7
0%
Mar 19Admidio is Missing CSRF Protection on Role Membership Date Changes
CVE-2026-30927
AD
admidio
Admidio
5.4
0%
Mar 9Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
CVE-2025-62617
AD
admidio
Admidio
7.2
0%
Oct 22Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
CVE-2024-47836
AD
Admidio
Admidio
4.3
1%
Oct 16Admidio is an open-source user management solution
CVE-2024-38529
AD
Admidio
Admidio
8.8
1%
Jul 29Admidio is a free, open source user management system for websites of organizations and groups
CVE-2024-37906
AD
Admidio
Admidio
8.8
1%
Jul 29Admidio is a free, open source user management system for websites of organizations and groups
CVE-2023-47380
AD
Admidio
Admidio
6.1
1%
Nov 22Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS)
CVE-2023-4190
AD
Admidio
Admidio
6.5
1%
Aug 6Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11