Read the docs

Admidio

Records73All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high22CVSS 7.0–8.9

Exploited now

Admidio records in CISA KEV

No Admidio vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Admidio 32 records HIGH

Records

73 records

TI-2026-56995 CVE-2026-82657 · GHSA-w236-q4gr-7x7m

Admidio before 5.0.12 Authentication Bypass via RSS feeds

Priority HIGH 77

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00451 Published 2026-08-30 Fixed in 5.0.12 CWE-200
TI-2026-56993 CVE-2026-82655 · GHSA-4rc8-26x9-r9p2

Admidio before 5.0.12 SQL Injection via relation_type_list

Priority HIGH 77

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00561 Published 2026-08-30 Fixed in 5.0.12 CWE-89
TI-2024-25222 CVE-2024-37906 · GHSA-69wx-xc6j-28v3

Admidio has Blind SQL Injection in ecard_send.php

Priority HIGH 76

Admidio is a free, open source user management system for websites of organizations and groups.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00931 Published 2024-07-29 Fixed in 4.3.9 CWE-89
TI-2026-76122 CVE-2026-111916 · GHSA-wwg7-jwv4-c2fh

Missing authorization in Admidio weblinks RSS feed exposes restricted links

Priority HIGH 70

Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00349 Published 2026-10-17 Fixed in 5.0.16 CWE-862
TI-2026-48499 CVE-2026-69092 · GHSA-hpm9-98gj-g9fr

Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint

Priority HIGH 70

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00376 Published 2026-08-03 Fixed in 5.0.11 CWE-79
TI-2018-15595 CVE-2018-25370 · GHSA-76g9-r7wc-v9q8

Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php

Priority HIGH 70

Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin checking.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00192 Published 2026-05-25 No fix listed CWE-352
TI-2026-34817 CVE-2026-47231 · GHSA-x628-457g-2pw9

Authorization bypass in admidio

Priority HIGH 68

Admidio is an open-source user management solution.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0035 Published 2026-08-12 Fixed in 5.0.10 CWE-639
TI-2023-03879 CVE-2023-4190 · GHSA-qq8m-9rpx-w2fm

Insufficient Session Expiration in admidio/admidio

Priority HIGH 68

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00603 Published 2023-08-06 Fixed in 4.2.11 CWE-613
TI-2026-76121 CVE-2026-111914 · GHSA-pf3j-3gfx-w49c

Missing authorization in Admidio exposes inventory data when module is disabled

Priority MEDIUM 64

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00311 Published 2026-10-17 Fixed in 5.0.16 CWE-862
TI-2026-48500 CVE-2026-69093 · GHSA-xp3j-j2g9-8cmv

Admidio before 5.0.11 CSRF via category-report preferences

Priority MEDIUM 64

Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy).

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00163 Published 2026-08-03 Fixed in 5.0.11 CWE-352
TI-2026-48497 CVE-2026-69090 · GHSA-jq7q-39fg-c24g

Admidio before 5.0.11 Cross-Organization Role Modification

Priority MEDIUM 64

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00344 Published 2026-08-03 Fixed in 5.0.11 CWE-862
Load more
Open these records in search →