CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The...

CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The...

CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The...

CVE-2024-38529

Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment (CVE-2024-38529). In versions before 4.3.10, the Message module allows uploading attachments without proper file extension verification, enabling upload of PHP files that can be accessed publicly at /adm_my_files/messages_a...

CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the /admprogram/modules/ecards/ecardsend.php source file of the Admidio Application. The SQL Injection results in a compromise of the...

CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the /admprogram/modules/ecards/ecardsend.php source file of the Admidio Application. The SQL Injection results in a compromise of the...

CVE-2024-37906

Admidio has a Blind SQL Injection in ecards/ecard_send.php affecting versions prior to 4.3.9. The vulnerability arises from directly concatenating the POST parameter ecard_recipients into the SQL query, allowing a member to trigger time-based, condition-based, or out-of-band payloads to compromis...

CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the /admprogram/modules/ecards/ecardsend.php source file of the Admidio Application. The SQL Injection results in a compromise of the...

Admidio 安全漏洞

Admidio is an open source member management system from the Admidio team. The system supports features such as member lists, event management, guestbooks, photo albums and downloads. A security vulnerability exists in Admidio versions prior to 4.3.9, which stems from the presence of a SQL injecti...

Admidio 安全漏洞

Admidio is an open source member management system from the Admidio team. The system supports features such as member lists, event management, guestbooks, photo albums and downloads. A security vulnerability exists in Admidio versions prior to 4.3.10, which stems from the presence of a remote cod...

Admidio has Blind SQL Injection in ecard_send.php

Description: An SQL Injection has been identified in the /admprogram/modules/ecards/ecardsend.php source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of ecardrecipients POST parameter is being directly concatenated with the SQ...

Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Description: Remote Code Execution Vulnerability has been identified in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL admidiobaseurl/admmyfiles/messagesattachments/filename. Th...

PT-2024-5494 · Admidio · Admidio

Name of the Vulnerable Software and Affected Versions: Admidio versions prior to 4.3.9 Description: The issue is related to an SQL Injection in the /adm program/modules/ecards/ecard send.php source file of the Admidio Application. This SQL Injection results in a compromise of the application's...

Cross-site Scripting (XSS)

admidio/admidio is vulnerable to Cross-Site Scripting. This vulnerability exists because it does not properly sanitize user input, allowing an attacker to inject and execute malicious JavaScript into the browser...

GHSA-VM4P-GH82-XQ96 Cross-site Scripting in Admidio

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting XSS...

Cross-site Scripting in Admidio

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting XSS...

CVE-2023-47380

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting XSS...

CVE-2023-47380

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting XSS...

Cross site scripting

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting XSS...

PT-2023-30437 · Admidio · Admidio

Name of the Vulnerable Software and Affected Versions: Admidio versions 4.2.12 and below Description: The issue is related to Cross Site Scripting XSS, which is a type of attack that can be used to steal user data or take control of user sessions. Recommendations: For Admidio versions 4.2.12 and...