# cve.now: Admidio

The newest entries naming Admidio as an affected vendor (up to 200), of 68 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-117554](https://cve.now/CVE-2026-117554.md): Admidio before 5.0.17 Event Guest Restriction Bypass via events\_function.php (CVSS 5.3)
- [CVE-2026-111916](https://cve.now/CVE-2026-111916.md): Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed (CVSS 6.9)
- [CVE-2026-111914](https://cve.now/CVE-2026-111914.md): Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory\_data.php (CVSS 7.1)
- [CVE-2026-111913](https://cve.now/CVE-2026-111913.md): Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists\_show.php (CVSS 5.3)
- [CVE-2026-111912](https://cve.now/CVE-2026-111912.md): Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update (CVSS 7.1)
- [CVE-2026-109329](https://cve.now/CVE-2026-109329.md): Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members\_assignment.php (CVSS 8.5)
- [CVE-2026-109328](https://cve.now/CVE-2026-109328.md): Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name (CVSS 5.3)
- [CVE-2026-109327](https://cve.now/CVE-2026-109327.md): Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php (CVSS 5.1)
- [CVE-2026-53760](https://cve.now/CVE-2026-53760.md): Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests (CVSS 5.2)
- [CVE-2026-82658](https://cve.now/CVE-2026-82658.md): Admidio before 5.0.12 Broken Access Control via profile\_function.php (CVSS 5.3)
- [CVE-2026-82657](https://cve.now/CVE-2026-82657.md): Admidio before 5.0.12 Authentication Bypass via RSS feeds (CVSS 8.7)
- [CVE-2026-82656](https://cve.now/CVE-2026-82656.md): Admidio before 5.0.12 Path Traversal via Photo ZIP Download (CVSS 2.1)
- [CVE-2026-82655](https://cve.now/CVE-2026-82655.md): Admidio before 5.0.12 SQL Injection via relation\_type\_list (CVSS 8.7)
- [CVE-2026-47234](https://cve.now/CVE-2026-47234.md): Admidio writes session IDs and auto-login cookie values to application logs (CVSS 4.4)
- [CVE-2026-47233](https://cve.now/CVE-2026-47233.md): Admidio: Any logged-in user can delete inventory fields via \`mode=field\_delete\` — incomplete fix of #2024 (CVSS 6.5)
- [CVE-2026-47232](https://cve.now/CVE-2026-47232.md): Admidio PKCS#12 private key export action lacks CSRF protection (CVSS 4.3)
- [CVE-2026-47231](https://cve.now/CVE-2026-47231.md): Admidio has IDOR in \`documents-files.php\` \`mode=move\_save\` that lets any folder-uploader exfiltrate files from private folders (CVSS 8.1)
- [CVE-2026-47230](https://cve.now/CVE-2026-47230.md): Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders (CVSS 6.5)
- [CVE-2026-47229](https://cve.now/CVE-2026-47229.md): Admidio: CSRF in SSO client \`enable\` action toggles SAML/OIDC clients without token validation (CVSS 5.4)
- [CVE-2026-47228](https://cve.now/CVE-2026-47228.md): Admidio's CSRF in registration \`send\_login\` mode resets arbitrary user passwords (CVSS 5.2)
- [CVE-2026-47227](https://cve.now/CVE-2026-47227.md): Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in \`modules/categories.php\` (CVSS 6.5)
- [CVE-2026-47226](https://cve.now/CVE-2026-47226.md): Admidio: Authorization bypass in file\_delete enables cross-folder file removal by authenticated users without delete privileges (CVSS 6.5)
- [CVE-2026-69094](https://cve.now/CVE-2026-69094.md): Admidio before 5.0.11 IDOR via save\_temporary mylist\_function.php (CVSS 5.3)
- [CVE-2026-69093](https://cve.now/CVE-2026-69093.md): Admidio before 5.0.11 CSRF via category-report preferences (CVSS 7.1)
- [CVE-2026-69092](https://cve.now/CVE-2026-69092.md): Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint (CVSS 6.9)
- [CVE-2026-69091](https://cve.now/CVE-2026-69091.md): Admidio before 5.0.11 Authentication Bypass via forum.php (CVSS 8.7)
- [CVE-2026-69090](https://cve.now/CVE-2026-69090.md): Admidio before 5.0.11 Cross-Organization Role Modification (CVSS 6.9)
- [CVE-2018-25370](https://cve.now/CVE-2018-25370.md): Admidio 3.3.5 Cross-Site Request Forgery via roles\_function.php (CVSS 6.9)
- [CVE-2026-42194](https://cve.now/CVE-2026-42194.md): Incomplete fix for CVE-2026-32812: SSRF in admidio (CVSS 6.8)
- [CVE-2026-41671](https://cve.now/CVE-2026-41671.md): Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation (CVSS 6.8)
- [CVE-2026-41670](https://cve.now/CVE-2026-41670.md): Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest (CVSS 8.2)
- [CVE-2026-41669](https://cve.now/CVE-2026-41669.md): Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed (CVSS 8.2)
- [CVE-2026-41663](https://cve.now/CVE-2026-41663.md): Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send (CVSS 3.5)
- [CVE-2026-41662](https://cve.now/CVE-2026-41662.md): Admidio: Missing Minimum Administrator Check in Role Membership Removal (CVSS 5.2)
- [CVE-2026-41661](https://cve.now/CVE-2026-41661.md): Admidio: Reflected XSS in msg\_window.php via Square Bracket to HTML Tag Conversion (CVSS 6.1)
- [CVE-2026-41660](https://cve.now/CVE-2026-41660.md): Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP (CVSS 7.1)
- [CVE-2026-41659](https://cve.now/CVE-2026-41659.md): Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment (CVSS 2.7)
- [CVE-2026-41658](https://cve.now/CVE-2026-41658.md): Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items (CVSS 6.5)
- [CVE-2026-41657](https://cve.now/CVE-2026-41657.md): Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts\_data.php (CVSS 4.9)
- [CVE-2026-41656](https://cve.now/CVE-2026-41656.md): Admidio: Path Traversal via Unvalidated \`name\` Parameter in Document Add Mode Enables Arbitrary Server File Read (CVSS 4.5)
- [CVE-2026-41655](https://cve.now/CVE-2026-41655.md): Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials (CVSS 6.5)
- [CVE-2026-34384](https://cve.now/CVE-2026-34384.md): Admidio: Missing CSRF Protection on Registration Approval Actions (CVSS 4.5)
- [CVE-2026-34383](https://cve.now/CVE-2026-34383.md): Admidio: CSRF and Form Validation Bypass in Inventory Item Save via \`imported\` Parameter (CVSS 4.3)
- [CVE-2026-34382](https://cve.now/CVE-2026-34382.md): Admidio: Missing CSRF Protection on Custom List Deletion in mylist\_function.php (CVSS 4.6)
- [CVE-2026-34381](https://cve.now/CVE-2026-34381.md): Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess (CVSS 7.5)
- [CVE-2026-32813](https://cve.now/CVE-2026-32813.md): Admidio: Second-Order SQL Injection via List Configuration (lsc\_special\_field, lsc\_sort, lsc\_filter) (CVSS 8.0)
- [CVE-2026-32817](https://cve.now/CVE-2026-32817.md): Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion (CVSS 9.1)
- [CVE-2026-32812](https://cve.now/CVE-2026-32812.md): Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint (CVSS 6.8)
- [CVE-2026-32757](https://cve.now/CVE-2026-32757.md): Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection (CVSS 5.4)
- [CVE-2026-32756](https://cve.now/CVE-2026-32756.md): Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module (CVSS 8.8)
- [CVE-2026-32818](https://cve.now/CVE-2026-32818.md): Admidio is Missing Authorization on Forum Topic and Post Deletion (CVSS 6.5)
- [CVE-2026-32816](https://cve.now/CVE-2026-32816.md): Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions (CVSS 5.7)
- [CVE-2026-32755](https://cve.now/CVE-2026-32755.md): Admidio is Missing CSRF Protection on Role Membership Date Changes (CVSS 5.7)
- [CVE-2026-30927](https://cve.now/CVE-2026-30927.md): Admidio: Event participation IDOR - non-leaders can register other users for events via user\_uuid parameter (CVSS 5.3)
- [CVE-2025-62617](https://cve.now/CVE-2025-62617.md): Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality (CVSS 7.2)
- [CVE-2024-47836](https://cve.now/CVE-2024-47836.md): Admidio vulnerable to HTML Injection In The Messages Section (CVSS 3.5)
- [CVE-2024-38529](https://cve.now/CVE-2024-38529.md): Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment (CVSS 9.1)
- [CVE-2024-37906](https://cve.now/CVE-2024-37906.md): Admidio has Blind SQL Injection in ecard\_send.php (CVSS 10.0)
- [CVE-2023-4190](https://cve.now/CVE-2023-4190.md): Insufficient Session Expiration in admidio/admidio (CVSS 6.5)
- [CVE-2023-3692](https://cve.now/CVE-2023-3692.md): Unrestricted Upload of File with Dangerous Type in admidio/admidio (CVSS 6.7)
- [CVE-2023-3304](https://cve.now/CVE-2023-3304.md): Improper Access Control in admidio/admidio (CVSS 5.9)
- [CVE-2023-3303](https://cve.now/CVE-2023-3303.md): Improper Access Control in admidio/admidio (CVSS 6.4)
- [CVE-2023-3302](https://cve.now/CVE-2023-3302.md): Improper Neutralization of Formula Elements in a CSV File in admidio/admidio (CVSS 6.6)
- [CVE-2023-3109](https://cve.now/CVE-2023-3109.md): Cross-site Scripting (XSS) - Stored in admidio/admidio (CVSS 6.3)
- [CVE-2022-0991](https://cve.now/CVE-2022-0991.md): Insufficient Session Expiration in admidio/admidio (CVSS 8.2)
- [CVE-2021-43810](https://cve.now/CVE-2021-43810.md): Cross-site Scripting (XSS) when redirect an url (CVSS 8.8)
- [CVE-2021-32630](https://cve.now/CVE-2021-32630.md): Various (CVSS 9.6)
- [CVE-2020-11004](https://cve.now/CVE-2020-11004.md): SQL Injection in Admidio (CVSS 7.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/admidio
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.