Vulnerabilities in Admidio

60 results
Vexday analysis

Admidio apresenta 34 vulnerabilidades cadastradas, com 14 publicadas nos últimos 90 dias, indicando atividade recente de descobertas. Nenhuma vulnerabilidade está sob exploração ativa (KEV), e apenas 4 atingem nível crítico, reduzindo o risco imediato. A fraqueza dominante é CWE-352 (Cross-Site Request Forgery), típica de aplicações web, exigindo atenção em controles de validação de origem de requisições.

CVE-2026-32818MEDIUMAdmidio is Missing Authorization on Forum Topic and Post DeletionEPSS 0.2%CVE-2026-47226MEDIUMAdmidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privilegesEPSS 0.2%CVE-2018-25370MEDIUMAdmidio 3.3.5 Cross-Site Request Forgery via roles_function.phpEPSS 0.2%CVE-2026-41669HIGHAdmidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests ProcessedEPSS 0.2%CVE-2026-69094MEDIUMAdmidio before 5.0.11 IDOR via save_temporary mylist_function.phpEPSS 0.2%CVE-2026-82658MEDIUMAdmidio before 5.0.12 Broken Access Control via profile_function.phpEPSS 0.2%CVE-2026-41661MEDIUMAdmidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionEPSS 0.2%CVE-2026-47230MEDIUMAdmidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploadersEPSS 0.2%CVE-2026-34384MEDIUMAdmidio: Missing CSRF Protection on Registration Approval ActionsEPSS 0.2%CVE-2026-32755MEDIUMAdmidio is Missing CSRF Protection on Role Membership Date ChangesEPSS 0.1%CVE-2026-53760MEDIUMAdmidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET RequestsEPSS 0.1%CVE-2026-34383MEDIUMAdmidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` ParameterEPSS 0.1%CVE-2026-47234MEDIUMAdmidio writes session IDs and auto-login cookie values to application logsEPSS 0.1%CVE-2026-32816MEDIUMAdmidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate ActionsEPSS 0.1%CVE-2026-69093HIGHAdmidio before 5.0.11 CSRF via category-report preferencesEPSS 0.1%CVE-2026-47228MEDIUMAdmidio's CSRF in registration `send_login` mode resets arbitrary user passwordsEPSS 0.1%CVE-2026-47232MEDIUMAdmidio PKCS#12 private key export action lacks CSRF protectionEPSS 0.1%CVE-2026-34382MEDIUMAdmidio: Missing CSRF Protection on Custom List Deletion in mylist_function.phpEPSS 0.1%CVE-2026-41663LOWAdmidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email SendEPSS 0.1%CVE-2026-47229MEDIUMAdmidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validationEPSS 0.1%