AAdmidio

Products

Exploited and recent CVEs

• CVE-2026-117554 Medium 4.3 Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php 0.3%
• CVE-2026-111916 Medium 5.3 Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed 0.3%
• CVE-2026-111914 Medium 6.5 Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php 0.3%
• CVE-2026-111913 Medium 4.3 Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php 0.2%
• CVE-2026-111912 Medium 6.5 Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update 0.2%
• CVE-2026-109329 Medium 6.5 Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php 0.3%
• CVE-2026-109328 Medium 6.1 Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name 0.2%
• CVE-2026-109327 Medium 6.1 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php 0.3%
• CVE-2026-53760 Medium 5.2 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests 0.2%
• CVE-2026-82658 Medium 4.3 Admidio before 5.0.12 Broken Access Control via profile_function.php 0.3%
• CVE-2026-82657 High 7.5 Admidio before 5.0.12 Authentication Bypass via RSS feeds 0.5%
• CVE-2026-82656 Low 2.6 Admidio before 5.0.12 Path Traversal via Photo ZIP Download 0.4%
• CVE-2026-82655 High 7.5 Admidio before 5.0.12 SQL Injection via relation_type_list 0.6%
• CVE-2026-47234 Medium 4.4 Admidio writes session IDs and auto-login cookie values to application logs 0.2%
• CVE-2026-47233 Medium 6.5 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 0.3%
• CVE-2026-47232 Medium 4.3 Admidio PKCS#12 private key export action lacks CSRF protection 0.1%
• CVE-2026-47231 High 8.1 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders 0.4%
• CVE-2026-47230 Medium 6.5 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders 0.3%
• CVE-2026-47229 Medium 5.4 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation 0.1%
• CVE-2026-47228 Medium 5.2 Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords 0.2%
• CVE-2026-47227 Medium 6.5 Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php` 0.3%
• CVE-2026-47226 Medium 6.5 Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges 0.3%
• CVE-2026-69094 Medium 4.3 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php 0.3%
• CVE-2026-69093 Medium 4.6 Admidio before 5.0.11 CSRF via category-report preferences 0.2%
• CVE-2026-69092 Medium 6.5 Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint 0.4%
• CVE-2026-69091 High 7.5 Admidio before 5.0.11 Authentication Bypass via forum.php 0.6%
• CVE-2026-69090 Medium 4.9 Admidio before 5.0.11 Cross-Organization Role Modification 0.3%
• CVE-2026-42194 Medium 6.8 Incomplete fix for CVE-2026-32812: SSRF in admidio 0.2%
• CVE-2026-41671 Medium 6.8 Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation 0.3%
• CVE-2026-41670 High 8.2 Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest 0.3%