Admidio vulnerabilities
68 CVEs and advisories name Admidio as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-117554Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
- CVE-2026-111916Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
- CVE-2026-111914Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
- CVE-2026-111913Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
- CVE-2026-111912Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
- CVE-2026-109329Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php
- CVE-2026-109328Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name
- CVE-2026-109327Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php
- CVE-2026-53760Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
- CVE-2026-82658Admidio before 5.0.12 Broken Access Control via profile_function.php
- CVE-2026-82657Admidio before 5.0.12 Authentication Bypass via RSS feeds
- CVE-2026-82656Admidio before 5.0.12 Path Traversal via Photo ZIP Download
- CVE-2026-82655Admidio before 5.0.12 SQL Injection via relation_type_list
- CVE-2026-47234Admidio writes session IDs and auto-login cookie values to application logs
- CVE-2026-47233Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
- CVE-2026-47232Admidio PKCS#12 private key export action lacks CSRF protection
- CVE-2026-47231Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
- CVE-2026-47230Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
- CVE-2026-47229Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
- CVE-2026-47228Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
- CVE-2026-47227Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
- CVE-2026-47226Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
- CVE-2026-69094Admidio before 5.0.11 IDOR via save_temporary mylist_function.php
- CVE-2026-69093Admidio before 5.0.11 CSRF via category-report preferences
- CVE-2026-69092Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint
- CVE-2026-69091Admidio before 5.0.11 Authentication Bypass via forum.php
- CVE-2026-69090Admidio before 5.0.11 Cross-Organization Role Modification
- CVE-2018-25370Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php
- CVE-2026-42194Incomplete fix for CVE-2026-32812: SSRF in admidio
- CVE-2026-41671Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation