Admidio vulnerabilities
68 CVEs and advisories name Admidio as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-41670Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest
- CVE-2026-41669Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed
- CVE-2026-41663Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send
- CVE-2026-41662Admidio: Missing Minimum Administrator Check in Role Membership Removal
- CVE-2026-41661Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
- CVE-2026-41660Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP
- CVE-2026-41659Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment
- CVE-2026-41658Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
- CVE-2026-41657Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php
- CVE-2026-41656Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read
- CVE-2026-41655Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials
- CVE-2026-34384Admidio: Missing CSRF Protection on Registration Approval Actions
- CVE-2026-34383Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter
- CVE-2026-34382Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php
- CVE-2026-34381Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
- CVE-2026-32813Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
- CVE-2026-32817Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
- CVE-2026-32812Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
- CVE-2026-32757Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
- CVE-2026-32756Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
- CVE-2026-32818Admidio is Missing Authorization on Forum Topic and Post Deletion
- CVE-2026-32816Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
- CVE-2026-32755Admidio is Missing CSRF Protection on Role Membership Date Changes
- CVE-2026-30927Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
- CVE-2025-62617Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
- CVE-2024-47836Admidio vulnerable to HTML Injection In The Messages Section
- CVE-2024-38529Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
- CVE-2024-37906Admidio has Blind SQL Injection in ecard_send.php
- CVE-2023-4190Insufficient Session Expiration in admidio/admidio
- CVE-2023-3692Unrestricted Upload of File with Dangerous Type in admidio/admidio