Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

admidio — Vulnerabilities & Security Advisories 61

All 61 CVE vulnerabilities found in admidio, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities for the open-source membership management software admidio, specifically focusing on web application weaknesses tagged with the product name. The collection encompasses a wide spectrum of reported issues ranging from cross-site scripting and SQL injection to improper access control and authentication bypasses, covering the historical timeline from the project's initial public release through the most recent security advisories. Visitors can utilize this resource to track the vendor's official security bulletins over time, analyze the prevalence and characteristics of specific weakness classes within the admidio codebase, or review the complete vulnerability history of the product to assess its current security posture. By consolidating data from multiple sources, this index provides a centralized view of past security events without relying on individual CVE identifiers, enabling administrators and security researchers to perform comprehensive risk assessments. The information presented is strictly factual and derived from public disclosures, offering a clear record of how the software has evolved in response to identified threats. Users seeking to understand the long-term security trajectory of admidio will find detailed summaries of each incident, including the nature of the flaw and the version affected, facilitating informed decisions regarding patch management and system hardening.

Vendor: Admidio

CVE ID Title CVSS Severity Published
CVE-2026-117554 Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php CWE-602 4.3 Medium 2026-10-27
CVE-2026-111916 Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed CWE-862 5.3 Medium 2026-10-17
CVE-2026-111914 Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php CWE-862 6.5 Medium 2026-10-17
CVE-2026-111913 Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php CWE-285 4.3 Medium 2026-10-17
CVE-2026-111912 Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update CWE-639 6.5 Medium 2026-10-17
CVE-2026-109329 Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php CWE-639 6.5 Medium 2026-10-12
CVE-2026-109328 Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name CWE-79 6.1 Medium 2026-10-12
CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php CWE-79 6.1 Medium 2026-10-12
CVE-2026-53760 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests CWE-352 5.2 Medium 2026-09-04
CVE-2026-82658 Admidio before 5.0.12 Broken Access Control via profile_function.php CWE-285 4.3 Medium 2026-08-30
CVE-2026-82656 Admidio before 5.0.12 Path Traversal via Photo ZIP Download CWE-22 2.6 Low 2026-08-30
CVE-2026-82657 Admidio before 5.0.12 Authentication Bypass via RSS feeds CWE-200 7.5 High 2026-08-30
CVE-2026-82655 Admidio before 5.0.12 SQL Injection via relation_type_list CWE-89 7.5 High 2026-08-30
CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs CWE-200 4.4 Medium 2026-08-12
CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 CWE-862 6.5 Medium 2026-08-12
CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection CWE-352 4.3 Medium 2026-08-12
CVE-2026-47231 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders CWE-639 8.1 High 2026-08-12
CVE-2026-47230 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders CWE-639 6.5 Medium 2026-08-12
CVE-2026-47229 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation CWE-352 5.4 Medium 2026-08-12
CVE-2026-47228 Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords CWE-352 5.2 Medium 2026-08-12
CVE-2026-47227 Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php` CWE-639 6.5 Medium 2026-08-12
CVE-2026-47226 Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges CWE-639 6.5 Medium 2026-08-12
CVE-2026-69094 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php CWE-639 4.3 Medium 2026-08-03
CVE-2026-69092 Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint CWE-79 6.5 Medium 2026-08-03
CVE-2026-69093 Admidio before 5.0.11 CSRF via category-report preferences CWE-352 4.6 Medium 2026-08-03
CVE-2026-69091 Admidio before 5.0.11 Authentication Bypass via forum.php CWE-306 7.5 High 2026-08-03
CVE-2026-69090 Admidio before 5.0.11 Cross-Organization Role Modification CWE-862 4.9 Medium 2026-08-03
CVE-2018-25370 Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php CWE-352 5.3 Medium 2026-05-25
CVE-2026-42194 Incomplete fix for CVE-2026-32812: SSRF in admidio CWE-918 6.8 Medium 2026-05-07
CVE-2026-41671 Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation CWE-287 6.8 Medium 2026-05-07

All 61 known CVE vulnerabilities affecting admidio with full Chinese analysis, references, and POCs where available.