CVE-2021-43810highCWE-79

CVE-2021-43810: high-severity vulnerability in admidio

Cross-site Scripting (XSS) when redirect an url

Published · Updated

Follow this CVE+ Monitor admidio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.8epss 5.1%
Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Admidio · admidio
Related CVEs — admidio

In the same product, most dangerous first.

CVE-2021-32630CRITICALVariousEPSS 1.6%CVE-2020-11004HIGHSQL Injection in AdmidioEPSS 1.5%CVE-2024-38529CRITICALAdmidio Vulnerable to RCE via Arbitrary File Upload in Message AttachmentEPSS 1.2%CVE-2026-32756HIGHAdmidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files ModuleEPSS 1.0%CVE-2024-37906CRITICALAdmidio has Blind SQL Injection in ecard_send.phpEPSS 0.9%CVE-2026-69091HIGHAdmidio before 5.0.11 Authentication Bypass via forum.phpEPSS 0.6%