CVE-2026-47234 | Medium | 4.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and… |
CVE-2026-47233 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/invent… |
CVE-2026-47232 | Medium | 4.3 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bun… |
CVE-2026-47231 | High | 8.1 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the acto… |
CVE-2026-47230 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause s… |
CVE-2026-47229 | Medium | 5.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing br… |
CVE-2026-47228 | Medium | 5.2 | 2026-08-12 | Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores… |
CVE-2026-47227 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) correspo… |
CVE-2026-47226 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanent… |
CVE-2026-69094 | Medium | 4.3 | 2026-08-03 | Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated us… |
CVE-2026-69093 | Medium | 4.6 | 2026-08-03 | Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration… |
CVE-2026-69092 | Medium | 6.5 | 2026-08-03 | Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the… |
CVE-2026-69091 | High | 7.5 | 2026-08-03 | Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modul… |
CVE-2026-69090 | Medium | 4.9 | 2026-08-03 | Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deacti… |
CVE-2018-25370 | Medium | 5.3 | 2026-05-25 | Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their permissions by exploiting improper origin c… |
CVE-2026-42194 | Medium | 6.8 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP a… |
CVE-2026-41671 | Medium | 6.8 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modules/sso/index.php/oidc/introspect) alwa… |
CVE-2026-41670 | High | 8.2 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServi… |
CVE-2026-41669 | High | 8.2 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio SAML Identity Provider implementation discards the return value of its… |
CVE-2026-41663 | Low | 3.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio's preferences module (database backup… |
CVE-2026-41662 | Medium | 5.2 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify whether removing a user from the administrat… |
CVE-2026-41661 | Medium | 6.1 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, an unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's… |
CVE-2026-41660 | High | 7.1 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorizatio… |
CVE-2026-41659 | Low | 2.7 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hi… |
CVE-2026-41658 | Medium | 6.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (del… |
CVE-2026-41657 | Medium | 4.9 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker permission check (isAdministratorUsers… |
CVE-2026-41656 | Medium | 4.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php accepts a name parameter validated only… |
CVE-2026-41655 | Medium | 6.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST param… |
CVE-2026-34384 | Medium | 4.5 | 2026-03-31 | Admidio is an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registratio… |
CVE-2026-34383 | Medium | 4.3 | 2026-03-31 | Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST paramete… |
CVE-2026-34382 | Medium | 4.6 | 2026-03-31 | Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, the delete mode handler in mylist_function.php permanently dele… |
CVE-2026-34381 | High | 7.5 | 2026-03-31 | Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP ac… |
CVE-2026-32817 | Critical | 9.1 | 2026-03-20 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user ha… |
CVE-2026-32813 | High | 8.0 | 2026-03-20 | Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature… |
CVE-2026-32812 | Medium | 6.8 | 2026-03-20 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and loca… |
CVE-2026-32757 | Medium | 5.4 | 2026-03-20 | Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the… |
CVE-2026-32756 | High | 8.8 | 2026-03-20 | Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files… |
CVE-2026-32818 | Medium | 6.5 | 2026-03-19 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in Admidio does not verify whether the current user has p… |
CVE-2026-32816 | Medium | 5.7 | 2026-03-19 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/groups-roles/groups_… |
CVE-2026-32755 | Medium | 5.7 | 2026-03-19 | Admidio is an open-source user management solution. In versions 5.0.6 and below, the save_membership action in modules/profile/profile_function.php saves chang… |
CVE-2026-30927 | Medium | 5.4 | 2026-03-10 | Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event participation logic allows any user who ca… |
CVE-2025-62617 | High | 7.2 | 2025-10-22 | Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data… |
CVE-2024-47836 | Low | 3.5 | 2024-10-16 | Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute… |
CVE-2024-38529 | Critical | 9.0 | 2024-07-29 | Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execut… |
CVE-2024-37906 | Critical | 9.9 | 2024-07-29 | Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in t… |
CVE-2023-47380 | Medium | 6.1 | 2023-11-22 | Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-4190 | Medium | 6.5 | 2023-08-06 | Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11. |
CVE-2023-3692 | High | 7.2 | 2023-07-16 | Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10. |
CVE-2023-3304 | Medium | 5.4 | 2023-06-23 | Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. |
CVE-2023-3303 | Low | 3.5 | 2023-06-23 | Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. |
CVE-2023-3302 | High | 7.8 | 2023-06-23 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9. |
CVE-2023-3109 | Medium | 5.4 | 2023-06-05 | Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8. |
CVE-2022-23896 | Medium | 5.4 | 2022-06-28 | Admidio 4.1.2 version is affected by stored cross-site scripting (XSS). |
CVE-2022-0991 | High | 7.1 | 2022-03-19 | Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. |
CVE-2021-43810 | High | 8.8 | 2021-12-07 | Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior… |
CVE-2021-32630 | Critical | 9.6 | 2021-05-20 | Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE… |
CVE-2020-11004 | High | 7.7 | 2020-04-24 | SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitiza… |
CVE-2017-8382 | Medium | 4.5 | 2017-05-16 | admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts. |
CVE-2017-6492 | High | 7.2 | 2017-03-05 | SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5. The POST parameter dat_cat_id is concatenated into a SQL query w… |
CVE-2008-5209 | | | 2008-11-24 | Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the f… |