Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

admidio — Vulnerabilities & Security Advisories 53

All 53 CVE vulnerabilities found in admidio, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities reported for the admidio web-based member management system, focusing on Common Weakness Enumeration categories and relevant vendor security advisories. It collects confirmed defects in the admidio software, covering a historical timeline from its initial open-source release through the most recent security updates. Readers can use this view to track the vendor’s advisory history, understand the prevalence of specific weakness classes within the product, and review the complete vulnerability timeline without manually searching individual databases.

Vendor: Admidio

CVE ID Title CVSS Severity Published
CVE-2026-53760 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests CWE-352 5.2 Medium 2026-09-04
CVE-2026-82658 Admidio before 5.0.12 Broken Access Control via profile_function.php CWE-285 4.3 Medium 2026-08-30
CVE-2026-82656 Admidio before 5.0.12 Path Traversal via Photo ZIP Download CWE-22 2.6 Low 2026-08-30
CVE-2026-82657 Admidio before 5.0.12 Authentication Bypass via RSS feeds CWE-200 7.5 High 2026-08-30
CVE-2026-82655 Admidio before 5.0.12 SQL Injection via relation_type_list CWE-89 7.5 High 2026-08-30
CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs CWE-200 4.4 Medium 2026-08-12
CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 CWE-862 6.5 Medium 2026-08-12
CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection CWE-352 4.3 Medium 2026-08-12
CVE-2026-47231 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders CWE-639 8.1 High 2026-08-12
CVE-2026-47230 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders CWE-639 6.5 Medium 2026-08-12
CVE-2026-47229 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation CWE-352 5.4 Medium 2026-08-12
CVE-2026-47228 Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords CWE-352 5.2 Medium 2026-08-12
CVE-2026-47227 Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php` CWE-639 6.5 Medium 2026-08-12
CVE-2026-47226 Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges CWE-639 6.5 Medium 2026-08-12
CVE-2026-69094 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php CWE-639 4.3 Medium 2026-08-03
CVE-2026-69092 Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint CWE-79 6.5 Medium 2026-08-03
CVE-2026-69093 Admidio before 5.0.11 CSRF via category-report preferences CWE-352 4.6 Medium 2026-08-03
CVE-2026-69091 Admidio before 5.0.11 Authentication Bypass via forum.php CWE-306 7.5 High 2026-08-03
CVE-2026-69090 Admidio before 5.0.11 Cross-Organization Role Modification CWE-862 4.9 Medium 2026-08-03
CVE-2018-25370 Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php CWE-352 5.3 Medium 2026-05-25
CVE-2026-42194 Incomplete fix for CVE-2026-32812: SSRF in admidio CWE-918 6.8 Medium 2026-05-07
CVE-2026-41671 Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation CWE-287 6.8 Medium 2026-05-07
CVE-2026-41670 Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest CWE-20 8.2 High 2026-05-07
CVE-2026-41669 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CWE-347 8.2 High 2026-05-07
CVE-2026-41663 Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send CWE-352 3.5 Low 2026-05-07
CVE-2026-41662 Admidio: Missing Minimum Administrator Check in Role Membership Removal CWE-754 5.2 Medium 2026-05-07
CVE-2026-41661 Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion CWE-79 6.1 Medium 2026-05-07
CVE-2026-41660 Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP CWE-863 7.1 High 2026-05-07
CVE-2026-41659 Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment CWE-200 2.7 Low 2026-05-07
CVE-2026-41658 Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items CWE-862 6.5 Medium 2026-05-07

All 53 known CVE vulnerabilities affecting admidio with full Chinese analysis, references, and POCs where available.