Admidio admidio

• CVE-2026-117554 Medium 4.3 Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php 0.3%
• CVE-2026-111916 Medium 5.3 Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed 0.3%
• CVE-2026-111914 Medium 6.5 Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php 0.3%
• CVE-2026-111913 Medium 4.3 Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php 0.2%
• CVE-2026-111912 Medium 6.5 Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update 0.2%
• CVE-2026-109329 Medium 6.5 Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php 0.3%
• CVE-2026-109328 Medium 6.1 Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name 0.2%
• CVE-2026-109327 Medium 6.1 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php 0.3%
• CVE-2026-53760 Medium 5.2 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests 0.2%
• CVE-2026-82658 Medium 4.3 Admidio before 5.0.12 Broken Access Control via profile_function.php 0.3%
• CVE-2026-82657 High 7.5 Admidio before 5.0.12 Authentication Bypass via RSS feeds 0.5%
• CVE-2026-82656 Low 2.6 Admidio before 5.0.12 Path Traversal via Photo ZIP Download 0.4%
• CVE-2026-82655 High 7.5 Admidio before 5.0.12 SQL Injection via relation_type_list 0.6%
• CVE-2026-47234 Medium 4.4 Admidio writes session IDs and auto-login cookie values to application logs 0.2%
• CVE-2026-47233 Medium 6.5 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 0.3%
• CVE-2026-47232 Medium 4.3 Admidio PKCS#12 private key export action lacks CSRF protection 0.1%
• CVE-2026-47231 High 8.1 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders 0.4%
• CVE-2026-47230 Medium 6.5 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders 0.3%
• CVE-2026-47229 Medium 5.4 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation 0.1%
• CVE-2026-47228 Medium 5.2 Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords 0.2%
• CVE-2026-47227 Medium 6.5 Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php` 0.3%
• CVE-2026-47226 Medium 6.5 Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges 0.3%
• CVE-2026-69094 Medium 4.3 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php 0.3%
• CVE-2026-69093 Medium 4.6 Admidio before 5.0.11 CSRF via category-report preferences 0.2%
• CVE-2026-69092 Medium 6.5 Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint 0.4%
• CVE-2026-69091 High 7.5 Admidio before 5.0.11 Authentication Bypass via forum.php 0.6%
• CVE-2026-69090 Medium 4.9 Admidio before 5.0.11 Cross-Organization Role Modification 0.3%
• CVE-2026-42194 Medium 6.8 Incomplete fix for CVE-2026-32812: SSRF in admidio 0.2%
• CVE-2026-41671 Medium 6.8 Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation 0.3%
• CVE-2026-41670 High 8.2 Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest 0.3%
• CVE-2026-41669 High 8.2 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed 0.2%
• CVE-2026-41663 Low 3.5 Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send 0.1%
• CVE-2026-41662 Medium 5.2 Admidio: Missing Minimum Administrator Check in Role Membership Removal 0.3%
• CVE-2026-41661 Medium 6.1 Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion 0.2%
• CVE-2026-41660 High 7.1 Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP 0.3%
• CVE-2026-41659 Low 2.7 Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment 0.3%
• CVE-2026-41658 Medium 6.5 Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items 0.2%
• CVE-2026-41657 Medium 4.9 Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php 0.3%
• CVE-2026-41656 Medium 4.5 Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read 0.4%
• CVE-2026-41655 Medium 6.5 Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials 0.3%
• CVE-2026-34384 Medium 4.5 Admidio: Missing CSRF Protection on Registration Approval Actions 0.2%
• CVE-2026-34383 Medium 4.3 Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter 0.1%
• CVE-2026-34382 Medium 4.6 Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php 0.1%
• CVE-2026-34381 High 7.5 Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess 0.6%
• CVE-2026-32813 High 8.0 Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter) 0.3%
• CVE-2026-32817 Critical 9.1 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion 0.3%
• CVE-2026-32812 Medium 6.8 Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint 0.4%
• CVE-2026-32757 Medium 5.4 Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection 0.2%
• CVE-2026-32756 High 8.8 Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module 1.0%
• CVE-2026-32818 Medium 6.5 Admidio is Missing Authorization on Forum Topic and Post Deletion 0.2%