Vulnerabilities in Admidio

46 results
Vexday analysis

Admidio apresenta 34 vulnerabilidades cadastradas, com 14 publicadas nos últimos 90 dias, indicando atividade recente de descobertas. Nenhuma vulnerabilidade está sob exploração ativa (KEV), e apenas 4 atingem nível crítico, reduzindo o risco imediato. A fraqueza dominante é CWE-352 (Cross-Site Request Forgery), típica de aplicações web, exigindo atenção em controles de validação de origem de requisições.

CVE-2026-32817CRITICALAdmidio is Missing Authorization and CSRF Protection on Document and Folder DeletionEPSS 0.3%CVE-2026-41657MEDIUMAdmidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.phpEPSS 0.3%CVE-2026-41655MEDIUMAdmidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database CredentialsEPSS 0.3%CVE-2026-41660HIGHAdmidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTPEPSS 0.3%CVE-2026-41662MEDIUMAdmidio: Missing Minimum Administrator Check in Role Membership RemovalEPSS 0.3%CVE-2026-41670HIGHAdmidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequestEPSS 0.3%CVE-2026-32813HIGHAdmidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)EPSS 0.3%CVE-2026-41659LOWAdmidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member AssignmentEPSS 0.3%CVE-2026-30927MEDIUMAdmidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameterEPSS 0.3%CVE-2026-42194MEDIUMIncomplete fix for CVE-2026-32812: SSRF in admidioEPSS 0.2%CVE-2026-32757MEDIUMAdmidio: HTMLPurifier Bypass in eCard Message Allows HTML Email InjectionEPSS 0.2%CVE-2026-41658MEDIUMAdmidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete ItemsEPSS 0.2%CVE-2026-32818MEDIUMAdmidio is Missing Authorization on Forum Topic and Post DeletionEPSS 0.2%CVE-2026-69092MEDIUMAdmidio before 5.0.11 Reflected XSS via SSO/SAML EndpointEPSS 0.2%CVE-2026-69090MEDIUMAdmidio before 5.0.11 Cross-Organization Role ModificationEPSS 0.2%CVE-2018-25370MEDIUMAdmidio 3.3.5 Cross-Site Request Forgery via roles_function.phpEPSS 0.2%CVE-2026-41669HIGHAdmidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests ProcessedEPSS 0.2%CVE-2026-41661MEDIUMAdmidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionEPSS 0.2%CVE-2026-34384MEDIUMAdmidio: Missing CSRF Protection on Registration Approval ActionsEPSS 0.2%CVE-2026-69094MEDIUMAdmidio before 5.0.11 IDOR via save_temporary mylist_function.phpEPSS 0.2%