Admidio

Records73All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high22CVSS 7.0–8.9

Exploited now

Admidio records in CISA KEV

No Admidio vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Admidio 32 records HIGH

Records

32 records in Admidio · all components

TI-2026-25286 CVE-2026-32817 · GHSA-rmpj-3x5m-9m5f

Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

HIGH 78

Admidio is an open-source user management solution.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00343 Published 2026-03-20 Fixed in 5.0.7 CWE-862

TI-2024-25222 CVE-2024-37906 · GHSA-69wx-xc6j-28v3

Admidio has Blind SQL Injection in ecard_send.php

HIGH 76

Admidio is a free, open source user management system for websites of organizations and groups.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00931 Published 2024-07-29 Fixed in 4.3.9 CWE-89

TI-2024-25764 CVE-2024-38529 · GHSA-g872-jwwr-vggm

Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

HIGH 74

Admidio is a free, open source user management system for websites of organizations and groups.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.01245 Published 2024-07-29 Fixed in 4.3.10 CWE-434

TI-2026-25247 CVE-2026-32756 · GHSA-95cq-p4w2-32w5

Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module

HIGH 73

Admidio is an open-source user management solution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01043 Published 2026-03-19 Fixed in 5.0.7 CWE-434

TI-2026-26667 CVE-2026-34381 · GHSA-7fh7-8xqm-3g88

Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess

HIGH 72

Admidio is an open-source user management solution.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-03-31 Fixed in 5.0.8 CWE-284

TI-2026-25282 CVE-2026-32813 · GHSA-3x67-4c2c-w45m

Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)

HIGH 70

Admidio is an open-source user management solution.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00296 Published 2026-03-20 Fixed in 5.0.7 CWE-89

TI-2023-03089 CVE-2023-3302 · GHSA-hm75-8w6h-4f8f

Improper Neutralization of Formula Elements in a CSV File in admidio/admidio

HIGH 69

Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00462 Published 2023-06-23 Fixed in 4.2.9 CWE-1236

TI-2023-03879 CVE-2023-4190 · GHSA-qq8m-9rpx-w2fm

Insufficient Session Expiration in admidio/admidio

HIGH 68

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00603 Published 2023-08-06 Fixed in 4.2.11 CWE-613

TI-2025-38832 CVE-2025-62617 · GHSA-2v5m-cq9w-fc33

Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality

HIGH 67

Admidio is an open-source user management solution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00433 Published 2025-10-22 Fixed in 4.3.17 CWE-89

TI-2023-03449 CVE-2023-3692 · GHSA-q347-jrx8-5pw9

Unrestricted Upload of File with Dangerous Type in admidio/admidio

HIGH 67

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01008 Published 2023-07-16 Fixed in 4.2.10 CWE-434

TI-2026-26670 CVE-2026-34384 · GHSA-ph84-r98x-2j22

Admidio: Missing CSRF Protection on Registration Approval Actions

HIGH 65

Admidio is an open-source user management solution.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00176 Published 2026-03-31 Fixed in 5.0.8 CWE-352

TI-2026-25281 CVE-2026-32812 · GHSA-6j68-gcc3-mq73

Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

MEDIUM 63

Admidio is an open-source user management solution.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00445 Published 2026-03-20 Fixed in 5.0.7 CWE-918

TI-2026-25287 CVE-2026-32818 · GHSA-g375-5wmp-xr78

Admidio is Missing Authorization on Forum Topic and Post Deletion

MEDIUM 62

Admidio is an open-source user management solution.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0024 Published 2026-03-19 Fixed in 5.0.7 CWE-862

TI-2026-25285 CVE-2026-32816 · GHSA-wwg8-6ffr-h4q2

Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions

MEDIUM 59

Admidio is an open-source user management solution.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00138 Published 2026-03-19 Fixed in 5.0.7 CWE-352

TI-2026-25246 CVE-2026-32755 · GHSA-h8gr-qwr6-m9gx

Admidio is Missing CSRF Protection on Role Membership Date Changes

MEDIUM 59

Admidio is an open-source user management solution.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00159 Published 2026-03-19 Fixed in 5.0.7 CWE-352

TI-2026-25248 CVE-2026-32757 · GHSA-4wr4-f2qf-x5wj

Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

MEDIUM 58

Admidio is an open-source user management solution.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00236 Published 2026-03-19 Fixed in 5.0.7 CWE-79

TI-2023-03091 CVE-2023-3304 · GHSA-x3m2-3pwj-8fj4

Improper Access Control in admidio/admidio

MEDIUM 58

Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00415 Published 2023-06-23 Fixed in 4.2.9 CWE-284

TI-2023-02914 CVE-2023-3109 · GHSA-gx4r-fvwg-8678

Cross-site Scripting (XSS) - Stored in admidio/admidio

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00479 Published 2023-06-05 Fixed in 4.2.8 CWE-79

TI-2026-26668 CVE-2026-34382 · GHSA-g3mx-8jm6-rc85

Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php

MEDIUM 54

Admidio is an open-source user management solution.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00128 Published 2026-03-31 Fixed in 5.0.8 CWE-352

TI-2026-26669 CVE-2026-34383 · GHSA-4rwm-c5mj-wh7x

Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter

MEDIUM 53

Admidio is an open-source user management solution.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00138 Published 2026-03-31 Fixed in 5.0.8 CWE-20

TI-2024-32103 CVE-2024-47836 · GHSA-7c4c-749j-pfp2

Admidio vulnerable to HTML Injection In The Messages Section

MEDIUM 53

Admidio is an open-source user management solution.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00511 Published 2024-10-16 Fixed in 4.3.12 CWE-502

TI-2023-03090 CVE-2023-3303 · GHSA-vmxg-wx6c-4f3r

Improper Access Control in admidio/admidio

MEDIUM 50

Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00416 Published 2023-06-23 Fixed in 4.2.9 CWE-284

TI-2021-19616 CVE-2021-43810

Cross-site Scripting (XSS) when redirect an url

MEDIUM 46

Admidio is a free open source user management system for websites of organizations and groups.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05076 Published 2021-12-07 Fixed in 4.0.12 CWE-79

TI-2021-12299 CVE-2021-32630

Unrestricted file upload in admidio

MEDIUM 44

Admidio is a free, open source user management system for websites of organizations and groups.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01593 Published 2021-05-20 Fixed in 4.0.4 CWE-434

TI-2020-08878 CVE-2020-11004

SQL Injection in Admidio

LOW 37

SQL Injection was discovered in Admidio before version 3.3.13.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.01515 Published 2020-04-24 Fixed in 3.3.13 CWE-89

Open these records in search →