Admidio - Cross-Site Scripting

A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The reflected cross-site scripting vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious...

Admidio-3.2.8-CSRF-POC-by-Provensec-llc

Admidio-3.2.8-CSRF-POC-by-Provensec-llc Admidio 3.2.8 Cross-Site Request Forgery Assigned CVE Number: CVE-2017-8382 https://www.exploit-db.com/exploits/42005/ http://en.0day.today/exploit/27771...

CVE-2026-117554

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additionalguests field when guests are disallowed. Attackers can set additionalguests to the remaining seat count in modules/events/eventsfunction.p...

CVE-2026-117554 Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additionalguests field when guests are disallowed. Attackers can set additionalguests to the remaining seat count in modules/events/eventsfunction.p...

CVE-2026-117554 Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additionalguests field when guests are disallowed. Attackers can set additionalguests to the remaining seat count in modules/events/eventsfunction.p...

EUVD-2026-110832

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additionalguests field when guests are disallowed. Attackers can set additionalguests to the remaining seat count in modules/events/eventsfunction.p...

CVE-2026-117554 Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additionalguests field when guests are disallowed. Attackers can set additionalguests to the remaining seat count in modules/events/eventsfunction.p...

CVE-2026-117554

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additionalguests field when guests are disallowed. Attackers can set additionalguests to the remaining seat count in modules/events/eventsfunction.p...

CVE-2026-117554

Admidio versions before 5.0.17 are vulnerable to an improper access control vulnerability in modules/events/events_function.php. Authenticated members can bypass guest restrictions by submitting the additional_guests field when guests are otherwise disallowed. This allows an attacker to set the v...

PT-2026-126413

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional guests field when guests are disallowed. Attackers can set additional guests to the remaining seat count in modules/events/events...

Admidio processing logic error vulnerability

Versions prior to Admidio 5.0.17 contain a logic error vulnerability stemming from improper access control. Authenticated members can register guest sessions via the additionalguests field in modules/events/eventsfunction.php when guests are prohibited; this sets the number of available seats to...

CVE-2026-111916

Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the categoryview role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names...

CVE-2026-111914

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory ite...

CVE-2026-111912

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic that allows authenticated members to modify other users' forum topics. Attackers can replace the topicuuid parameter in their own topicsave request, reusing their CSRF token, to...

CVE-2026-111913

Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groupsrolesexport check in modules/groups-roles/listsshow.php omits pdfl, which later runs the pdf export, letti...

EUVD-2026-103305

Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the categoryview role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names...

CVE-2026-111914 Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory ite...

EUVD-2026-103306

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory ite...

CVE-2026-111916

Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the categoryview role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names...

CVE-2026-111914 Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory ite...