Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

admidio — Vulnerabilities & Security Advisories 61

All 61 CVE vulnerabilities found in admidio, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities for the open-source membership management software admidio, specifically focusing on web application weaknesses tagged with the product name. The collection encompasses a wide spectrum of reported issues ranging from cross-site scripting and SQL injection to improper access control and authentication bypasses, covering the historical timeline from the project's initial public release through the most recent security advisories. Visitors can utilize this resource to track the vendor's official security bulletins over time, analyze the prevalence and characteristics of specific weakness classes within the admidio codebase, or review the complete vulnerability history of the product to assess its current security posture. By consolidating data from multiple sources, this index provides a centralized view of past security events without relying on individual CVE identifiers, enabling administrators and security researchers to perform comprehensive risk assessments. The information presented is strictly factual and derived from public disclosures, offering a clear record of how the software has evolved in response to identified threats. Users seeking to understand the long-term security trajectory of admidio will find detailed summaries of each incident, including the nature of the flaw and the version affected, facilitating informed decisions regarding patch management and system hardening.

Vendor: Admidio

CVE ID Title CVSS Severity Published
CVE-2026-41670 Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest CWE-20 8.2 High 2026-05-07
CVE-2026-41669 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CWE-347 8.2 High 2026-05-07
CVE-2026-41663 Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send CWE-352 3.5 Low 2026-05-07
CVE-2026-41662 Admidio: Missing Minimum Administrator Check in Role Membership Removal CWE-754 5.2 Medium 2026-05-07
CVE-2026-41661 Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion CWE-79 6.1 Medium 2026-05-07
CVE-2026-41660 Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP CWE-863 7.1 High 2026-05-07
CVE-2026-41659 Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment CWE-200 2.7 Low 2026-05-07
CVE-2026-41658 Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items CWE-862 6.5 Medium 2026-05-07
CVE-2026-41657 Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php CWE-863 4.9 Medium 2026-05-07
CVE-2026-41656 Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read CWE-22 4.5 Medium 2026-05-07
CVE-2026-41655 Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials CWE-22 6.5 Medium 2026-05-07
CVE-2026-34384 Admidio: Missing CSRF Protection on Registration Approval Actions CWE-352 4.5 Medium 2026-03-31
CVE-2026-34383 Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter CWE-20 4.3 Medium 2026-03-31
CVE-2026-34382 Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php CWE-352 4.6 Medium 2026-03-31
CVE-2026-34381 Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess CWE-284 7.5 High 2026-03-31
CVE-2026-32813 Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter) CWE-89 8.0 High 2026-03-20
CVE-2026-32817 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CWE-862 9.1 Critical 2026-03-20
CVE-2026-32812 Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint CWE-918 6.8 Medium 2026-03-20
CVE-2026-32757 Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection CWE-79 5.4 Medium 2026-03-19
CVE-2026-32756 Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module CWE-434 8.8 High 2026-03-19
CVE-2026-32818 Admidio is Missing Authorization on Forum Topic and Post Deletion CWE-862 6.5 Medium 2026-03-19
CVE-2026-32816 Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions CWE-352 5.7 Medium 2026-03-19
CVE-2026-32755 Admidio is Missing CSRF Protection on Role Membership Date Changes CWE-352 5.7 Medium 2026-03-19
CVE-2026-30927 Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter CWE-639 5.4AI Medium AI 2026-03-09
CVE-2025-62617 Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality CWE-89 7.2 High 2025-10-22
CVE-2024-47836 Admidio vulnerable to HTML Injection In The Messages Section CWE-502 3.5 Low 2024-10-16
CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CWE-434 9.1 Critical 2024-07-29
CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php CWE-89 10.0 Critical 2024-07-29
CVE-2021-43810 Cross-site Scripting (XSS) when redirect an url CWE-79 8.8 High 2021-12-07
CVE-2021-32630 Various CWE-434 9.6 Critical 2021-05-20

All 61 known CVE vulnerabilities affecting admidio with full Chinese analysis, references, and POCs where available.