Security
فارسی
All products

admidio/admidio

Composer · Package
50 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024CVE-2026-47233 · GHSA-XW54-C3MX-9PM3 admidio/admidio Composer Medium Fix reported
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validationCVE-2026-47229 · GHSA-XG76-5QJ2-2HHV admidio/admidio Composer Medium Fix reported
Admidio writes session IDs and auto-login cookie values to application logsCVE-2026-47234 · GHSA-MCH8-WF3H-6X88 admidio/admidio Composer Medium Fix reported
Admidio PKCS#12 private key export action lacks CSRF protectionCVE-2026-47232 · GHSA-4RGQ-38MH-9XQG admidio/admidio Composer Medium Fix reported
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploadersCVE-2026-47230 · GHSA-Q6W3-HPFV-RG36 admidio/admidio Composer Medium Fix reported
Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private foldersCVE-2026-47231 · GHSA-X628-457G-2PW9 admidio/admidio Composer High Fix reported
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privilegesCVE-2026-47226 · GHSA-QC4C-HRMC-4F78 admidio/admidio Composer Medium Fix reported
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwordsCVE-2026-47228 · GHSA-MX25-J3RC-6W2W admidio/admidio Composer Medium Fix reported
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`CVE-2026-47227 · GHSA-RWJR-QJJ3-MQ2F admidio/admidio Composer Medium Fix reported
Admidio has Blind SQL Injection in ecard_send.phpCVE-2024-37906 · GHSA-69WX-XC6J-28V3 admidio/admidio Composer Critical Fix reported
Admidio Vulnerable to RCE via Arbitrary File Upload in Message AttachmentCVE-2024-38529 · GHSA-G872-JWWR-VGGM admidio/admidio Composer Critical Fix reported
Admidio is Missing Authorization and CSRF Protection on Document and Folder DeletionCVE-2026-32817 · GHSA-RMPJ-3X5M-9M5F admidio/admidio Composer Critical Fix reported
Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET RequestsCVE-2026-53760 · GHSA-HM42-Q32M-VJ4F admidio/admidio Composer Medium No fix reported
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequestCVE-2026-41670 · GHSA-P9W9-87C8-M235 admidio/admidio Composer High Fix reported
Admidio Missing Minimum Administrator Check in Role Membership RemovalCVE-2026-41662 · GHSA-C7XM-R6VJ-8VG6 admidio/admidio Composer Medium Fix reported
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionCVE-2026-41661 · GHSA-GQ27-FC8W-VCMP admidio/admidio Composer Medium Fix reported
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without ValidationCVE-2026-41671 · GHSA-9XX5-CV6J-X533 admidio/admidio Composer Medium Fix reported
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequestsCVE-2026-41669 · GHSA-25CW-98HG-G3CG admidio/admidio Composer High Fix reported
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member AssignmentCVE-2026-41659 · GHSA-68PR-7PRH-MPV4 admidio/admidio Composer Low Fix reported
Admidio has an incomplete fix for CVE-2026-32812 (SSRF)CVE-2026-42194 · GHSA-HCJJ-CHVW-FMW9 admidio/admidio Composer Medium Fix reported