Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: admidio 5.0.12 Clear all filters
TI-2026-56996 CVE-2026-82658 · GHSA-7mr9-2w6x-hw8r

Admidio before 5.0.12 Broken Access Control via profile_function.php

Priority MEDIUM 57

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00305 Published 2026-08-30 Fixed in 5.0.12 CWE-285
TI-2026-56995 CVE-2026-82657 · GHSA-w236-q4gr-7x7m

Admidio before 5.0.12 Authentication Bypass via RSS feeds

Priority HIGH 77

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00451 Published 2026-08-30 Fixed in 5.0.12 CWE-200
TI-2026-56994 CVE-2026-82656 · GHSA-97g5-g4rj-rr3j

Admidio before 5.0.12 Path Traversal via Photo ZIP Download

Priority LOW 12

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00437 Published 2026-08-30 Fixed in 5.0.12 CWE-22
TI-2026-56993 CVE-2026-82655 · GHSA-4rc8-26x9-r9p2

Admidio before 5.0.12 SQL Injection via relation_type_list

Priority HIGH 77

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00561 Published 2026-08-30 Fixed in 5.0.12 CWE-89