Admidio Security Vulnerabilities

CVE-2023-47380

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting...

CVE-2023-4190

Insufficient Session Expiration in GitHub repository admidio/admidio prior to...

CVE-2023-3692

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to...

CVE-2023-3304

Improper Access Control in GitHub repository admidio/admidio prior to...

CVE-2023-3302

Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to...

CVE-2023-3303

Improper Access Control in GitHub repository admidio/admidio prior to...

CVE-2023-3109

Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to...

CVE-2022-23896

Admidio 4.1.2 version is affected by stored cross-site scripting...

CVE-2022-0991

Insufficient Session Expiration in GitHub repository admidio/admidio prior to...

CVE-2021-43810

Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter......

CVE-2021-32630

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Someone with upload permissions could...

CVE-2020-11004

SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute...

CVE-2017-8382

admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user...

CVE-2017-6492

SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5. The POST parameter dat_cat_id is concatenated into a SQL query without any input...

CVE-2008-5209

Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file...