Vulnerabilidades em Admidio
68 resultadosAnálise Vexday
Admidio apresenta 34 vulnerabilidades cadastradas, com 14 publicadas nos últimos 90 dias, indicando atividade recente de descobertas. Nenhuma vulnerabilidade está sob exploração ativa (KEV), e apenas 4 atingem nível crítico, reduzindo o risco imediato. A fraqueza dominante é CWE-352 (Cross-Site Request Forgery), típica de aplicações web, exigindo atenção em controles de validação de origem de requisições.
CVE-2023-3304MEDIUMImproper Access Control in admidio/admidioEPSS 0.4%CVE-2026-69092MEDIUMAdmidio before 5.0.11 Reflected XSS via SSO/SAML EndpointEPSS 0.4%CVE-2026-41656MEDIUMAdmidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File ReadEPSS 0.4%CVE-2026-47231HIGHAdmidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private foldersEPSS 0.4%CVE-2026-111916MEDIUMAdmidio before 5.0.16 Information Disclosure via rss/links.php Weblinks FeedEPSS 0.3%CVE-2026-47226MEDIUMAdmidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privilegesEPSS 0.3%CVE-2026-69090MEDIUMAdmidio before 5.0.11 Cross-Organization Role ModificationEPSS 0.3%CVE-2026-32817CRITICALAdmidio is Missing Authorization and CSRF Protection on Document and Folder DeletionEPSS 0.3%CVE-2026-47227MEDIUMAdmidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`EPSS 0.3%CVE-2026-41671MEDIUMAdmidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without ValidationEPSS 0.3%CVE-2026-41657MEDIUMAdmidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.phpEPSS 0.3%CVE-2026-111914HIGHAdmidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.phpEPSS 0.3%CVE-2026-47233MEDIUMAdmidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024EPSS 0.3%CVE-2026-41655MEDIUMAdmidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database CredentialsEPSS 0.3%CVE-2026-82658MEDIUMAdmidio before 5.0.12 Broken Access Control via profile_function.phpEPSS 0.3%CVE-2026-47230MEDIUMAdmidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploadersEPSS 0.3%CVE-2026-41660HIGHAdmidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTPEPSS 0.3%CVE-2026-32813HIGHAdmidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)EPSS 0.3%CVE-2026-117554MEDIUMAdmidio before 5.0.17 Event Guest Restriction Bypass via events_function.phpEPSS 0.3%CVE-2026-41662MEDIUMAdmidio: Missing Minimum Administrator Check in Role Membership RemovalEPSS 0.3%