CVEs we hold for Admidio

Records whose assigning authority named Admidio as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-82658Admidio before 5.0.12 Broken Access Control via profile_function.phpadmidio

CVE-2026-82657Admidio before 5.0.12 Authentication Bypass via RSS feedsadmidio

CVE-2026-82656Admidio before 5.0.12 Path Traversal via Photo ZIP Downloadadmidio

CVE-2026-82655Admidio before 5.0.12 SQL Injection via relation_type_listadmidio

CVE-2026-69094Admidio before 5.0.11 IDOR via save_temporary mylist_function.phpadmidio

CVE-2026-69093Admidio before 5.0.11 CSRF via category-report preferencesadmidio

CVE-2026-69092Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpointadmidio

CVE-2026-69091Admidio before 5.0.11 Authentication Bypass via forum.phpadmidio

CVE-2026-69090Admidio before 5.0.11 Cross-Organization Role Modificationadmidio

CVE-2026-53760Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requestsadmidio

CVE-2026-47234Admidio writes session IDs and auto-login cookie values to application logsadmidio

CVE-2026-47233Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024admidio

CVE-2026-47232Admidio PKCS#12 private key export action lacks CSRF protectionadmidio

CVE-2026-47231Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private…admidio

CVE-2026-47230Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploadersadmidio

CVE-2026-47229Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validationadmidio

CVE-2026-47228Admidio's CSRF in registration `send_login` mode resets arbitrary user passwordsadmidio

CVE-2026-47227Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in…admidio

CVE-2026-47226Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete…admidio

CVE-2026-42194Incomplete fix for CVE-2026-32812: SSRF in admidioadmidio

CVE-2026-41671Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validationadmidio

CVE-2026-41670Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequestadmidio

CVE-2026-41669Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processedadmidio

CVE-2026-41663Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Sendadmidio

CVE-2026-41662Admidio: Missing Minimum Administrator Check in Role Membership Removaladmidio

CVE-2026-41661Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversionadmidio

CVE-2026-41660Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTPadmidio

CVE-2026-41659Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignmentadmidio

CVE-2026-41658Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Itemsadmidio

CVE-2026-41657Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.phpadmidio

CVE-2026-41656Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Readadmidio

CVE-2026-41655Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentialsadmidio

CVE-2026-34384Admidio: Missing CSRF Protection on Registration Approval Actionsadmidio

CVE-2026-34383Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameteradmidio

CVE-2026-34382Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.phpadmidio

CVE-2026-34381Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccessadmidio

CVE-2026-32818Admidio is Missing Authorization on Forum Topic and Post Deletionadmidio

CVE-2026-32817Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletionadmidio

CVE-2026-32816Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actionsadmidio

CVE-2026-32813Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)admidio

CVE-2026-32812Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpointadmidio

CVE-2026-32757Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injectionadmidio

CVE-2026-32756Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Moduleadmidio

CVE-2026-32755Admidio is Missing CSRF Protection on Role Membership Date Changesadmidio

CVE-2026-30927Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameteradmidio

CVE-2025-62617Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionalityadmidio

CVE-2024-47836Admidio vulnerable to HTML Injection In The Messages Sectionadmidio

CVE-2024-38529Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachmentadmidio

CVE-2024-37906Admidio has Blind SQL Injection in ecard_send.phpadmidio

CVE-2023-4190Insufficient Session Expiration in admidio/admidioadmidio/admidio

CVE-2023-3692Unrestricted Upload of File with Dangerous Type in admidio/admidioadmidio/admidio

CVE-2023-3304Improper Access Control in admidio/admidioadmidio/admidio

CVE-2023-3303Improper Access Control in admidio/admidioadmidio/admidio

CVE-2023-3302Improper Neutralization of Formula Elements in a CSV File in admidio/admidioadmidio/admidio

CVE-2023-3109Cross-site Scripting (XSS) - Stored in admidio/admidioadmidio/admidio

CVE-2022-0991Insufficient Session Expiration in admidio/admidioadmidio/admidio

CVE-2021-43810Cross-site Scripting (XSS) when redirect an urladmidio

CVE-2021-32630Variousadmidio

CVE-2020-11004SQL Injection in Admidioadmidio

CVE-2018-25370Admidio 3.3.5 Cross-Site Request Forgery via roles_function.phpAdmidio

60 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.