Admidio records

32 published records for vendor admidio.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 93.8%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

32 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-32817No exploit	Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletionadmidio · admidio · CWE-862 Pre-auth Broken access control (IDOR) CSRF	Critical9.1	—	0.3%	Mar 19, 2026
35Monitor	CVE-2021-32630No exploit	Admidio is a free, open source user management system for websites of organizations and groups.admidio · admidio · CWE-434 RCE File upload	High8.8	—	1.5%	May 20, 2021
35Monitor	CVE-2024-38529No exploit	Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachmentadmidio · admidio · CWE-434 RCE File upload	High8.8	—	1.2%	Jul 29, 2024
35Monitor	CVE-2026-32756No exploit	Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Moduleadmidio · admidio · CWE-434 RCE File upload CSRF	High8.8	—	1.0%	Mar 19, 2026
35Monitor	CVE-2024-37906No exploit	Admidio has Blind SQL Injection in ecard_send.phpadmidio · admidio · CWE-89 SQL injection	High8.8	—	0.9%	Jul 29, 2024
32Monitor	CVE-2026-32813No exploit	Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)admidio · admidio · CWE-89 SQL injection	High8.0	—	0.2%	Mar 19, 2026
31Monitor	CVE-2023-3302No exploit	Improper Neutralization of Formula Elements in a CSV File in admidio/admidioadmidio · admidio · CWE-1236	High7.8	—	0.4%	Jun 23, 2023
30Monitor	CVE-2020-11004No exploit	SQL Injection in Admidioadmidio · admidio · CWE-89 Pre-auth SQL injection	High7.5	—	1.5%	Apr 24, 2020
30Monitor	CVE-2026-34381No exploit	Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccessadmidio · admidio · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	High7.5	—	0.5%	Mar 31, 2026
29Monitor	CVE-2026-34384No exploit	Admidio: Missing CSRF Protection on Registration Approval Actionsadmidio · admidio · CWE-352 CSRF	High7.3	—	0.1%	Mar 31, 2026
28Monitor	CVE-2017-6492No exploit	SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5.admidio · admidio · CWE-89 SQL injection	High7.2	—	1.3%	Mar 5, 2017
28Monitor	CVE-2022-0991No exploit	Insufficient Session Expiration in admidio/admidioadmidio · admidio · CWE-613	High7.1	—	1.0%	Mar 19, 2022
28Monitor	CVE-2023-3692No exploit	Unrestricted Upload of File with Dangerous Type in admidio/admidioadmidio · admidio · CWE-434 File upload	High7.2	—	1.0%	Jul 15, 2023
28Monitor	CVE-2025-62617No exploit	Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionalityadmidio · admidio · CWE-89 RCE SQL injection	High7.2	—	0.4%	Oct 22, 2025
27Monitor	CVE-2026-32812No exploit	Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpointadmidio · admidio · CWE-918 SSRF	Medium6.8	—	0.4%	Mar 19, 2026
26Monitor	CVE-2021-43810Proof of concept	Cross-site Scripting (XSS) when redirect an urladmidio · admidio · CWE-79 Pre-auth XSS	Medium6.1	—	5.0%	Dec 7, 2021
26Monitor	CVE-2023-4190No exploit	Insufficient Session Expiration in admidio/admidioadmidio · admidio · CWE-613 Pre-auth	Medium6.5	—	0.6%	Aug 5, 2023
26Monitor	CVE-2026-32818No exploit	Admidio is Missing Authorization on Forum Topic and Post Deletionadmidio · admidio · CWE-862 Broken access control (IDOR) CSRF	Medium6.5	—	0.2%	Mar 19, 2026
24Monitor	CVE-2023-47380No exploit	Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS).admidio · admidio · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Nov 22, 2023
22Monitor	CVE-2026-32755No exploit	Admidio is Missing CSRF Protection on Role Membership Date Changesadmidio · admidio · CWE-352 CSRF	Medium5.7	—	0.1%	Mar 19, 2026
22Monitor	CVE-2026-32816No exploit	Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actionsadmidio · admidio · CWE-352 CSRF	Medium5.7	—	0.1%	Mar 19, 2026
21Monitor	CVE-2008-5209Proof of concept	Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a ..admidio · admidio · CWE-22 Pre-auth Path traversal	Medium5.0	—	2.7%	Nov 24, 2008
21Monitor	CVE-2022-23896No exploit	Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).admidio · admidio · CWE-79 XSS	Medium5.4	—	0.5%	Jun 28, 2022
21Monitor	CVE-2023-3109No exploit	Cross-site Scripting (XSS) - Stored in admidio/admidioadmidio · admidio · CWE-79 XSS	Medium5.4	—	0.4%	Jun 5, 2023
21Monitor	CVE-2023-3304No exploit	Improper Access Control in admidio/admidioadmidio · admidio · CWE-284 Broken access control (IDOR)	Medium5.4	—	0.4%	Jun 23, 2023

CVE-2026-32817
36Monitor
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- CSRF
admidio · admidioMar 19, 2026
CVE-2021-32630
35Monitor
Admidio is a free, open source user management system for websites of organizations and groups.
HighCVSS 8.8No exploitEPSS 1%
- RCE
- File upload
admidio · admidioMay 20, 2021
CVE-2024-38529
35Monitor
Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
HighCVSS 8.8No exploitEPSS 1%
- RCE
- File upload
admidio · admidioJul 29, 2024
CVE-2026-32756
35Monitor
Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
HighCVSS 8.8No exploitEPSS 1%
- RCE
- File upload
- CSRF
admidio · admidioMar 19, 2026
CVE-2024-37906
35Monitor
Admidio has Blind SQL Injection in ecard_send.php
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
admidio · admidioJul 29, 2024
CVE-2026-32813
32Monitor
Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
HighCVSS 8.0No exploitEPSS 0%
- SQL injection
admidio · admidioMar 19, 2026
CVE-2023-3302
31Monitor
Improper Neutralization of Formula Elements in a CSV File in admidio/admidio
HighCVSS 7.8No exploitEPSS 0%
admidio · admidioJun 23, 2023
CVE-2020-11004
30Monitor
SQL Injection in Admidio
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- SQL injection
admidio · admidioApr 24, 2020
CVE-2026-34381
30Monitor
Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
admidio · admidioMar 31, 2026
CVE-2026-34384
29Monitor
Admidio: Missing CSRF Protection on Registration Approval Actions
HighCVSS 7.3No exploitEPSS 0%
- CSRF
admidio · admidioMar 31, 2026
CVE-2017-6492
28Monitor
SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5.
HighCVSS 7.2No exploitEPSS 1%
- SQL injection
admidio · admidioMar 5, 2017
CVE-2022-0991
28Monitor
Insufficient Session Expiration in admidio/admidio
HighCVSS 7.1No exploitEPSS 1%
admidio · admidioMar 19, 2022
CVE-2023-3692
28Monitor
Unrestricted Upload of File with Dangerous Type in admidio/admidio
HighCVSS 7.2No exploitEPSS 1%
- File upload
admidio · admidioJul 15, 2023
CVE-2025-62617
28Monitor
Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
HighCVSS 7.2No exploitEPSS 0%
- RCE
- SQL injection
admidio · admidioOct 22, 2025
CVE-2026-32812
27Monitor
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
MediumCVSS 6.8No exploitEPSS 0%
- SSRF
admidio · admidioMar 19, 2026
CVE-2021-43810
26Monitor
Cross-site Scripting (XSS) when redirect an url
MediumCVSS 6.1Proof of conceptEPSS 5%
- Pre-auth
- XSS
admidio · admidioDec 7, 2021
CVE-2023-4190
26Monitor
Insufficient Session Expiration in admidio/admidio
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
admidio · admidioAug 5, 2023
CVE-2026-32818
26Monitor
Admidio is Missing Authorization on Forum Topic and Post Deletion
MediumCVSS 6.5No exploitEPSS 0%
- Broken access control (IDOR)
- CSRF
admidio · admidioMar 19, 2026
CVE-2023-47380
24Monitor
Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS).
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
admidio · admidioNov 22, 2023
CVE-2026-32755
22Monitor
Admidio is Missing CSRF Protection on Role Membership Date Changes
MediumCVSS 5.7No exploitEPSS 0%
- CSRF
admidio · admidioMar 19, 2026
CVE-2026-32816
22Monitor
Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions
MediumCVSS 5.7No exploitEPSS 0%
- CSRF
admidio · admidioMar 19, 2026
CVE-2008-5209
21Monitor
Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a ..
MediumCVSS 5.0Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
admidio · admidioNov 24, 2008
CVE-2022-23896
21Monitor
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
MediumCVSS 5.4No exploitEPSS 0%
- XSS
admidio · admidioJun 28, 2022
CVE-2023-3109
21Monitor
Cross-site Scripting (XSS) - Stored in admidio/admidio
MediumCVSS 5.4No exploitEPSS 0%
- XSS
admidio · admidioJun 5, 2023
CVE-2023-3304
21Monitor
Improper Access Control in admidio/admidio
MediumCVSS 5.4No exploitEPSS 0%
- Broken access control (IDOR)
admidio · admidioJun 23, 2023