638 matches found
CVE-2026-69093 Admidio before 5.0.11 CSRF via category-report preferences
Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...
CVE-2026-69093
Admidio prior to 5.0.11 contains a CSRF weakness in modules/category-report/preferences.php: adm_csrf_token is not validated, allowing an authenticated admin to be tricked into visiting a crafted URL that can delete or copy Category Report configurations via GET parameters. This affects integrity...
EUVD-2026-52286
Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...
CVE-2026-69092 Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...
CVE-2026-69092
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...
EUVD-2026-52285
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...
CVE-2026-69092
CVE-2026-69092 affects Admidio versions before 5.0.11. The issue is a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or Ligh...
CVE-2026-69092 Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...
EUVD-2026-52283
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...
CVE-2026-69090
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...
CVE-2026-69091 Admidio before 5.0.11 Authentication Bypass via forum.php
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...
CVE-2026-69090 Admidio before 5.0.11 Cross-Organization Role Modification
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...
CVE-2026-69091
Admidio before 5.0.11 has an authentication bypass in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with ...
CVE-2026-69091 Admidio before 5.0.11 Authentication Bypass via forum.php
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...
CVE-2026-69090
CVE-2026-69090 (Admidio) affects Admidio prior to 5.0.11. The issue is failure to validate target organization membership in role handlers, enabling authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID ...
EUVD-2026-52284
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...
CVE-2026-69090 Admidio before 5.0.11 Cross-Organization Role Modification
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...
CVE-2026-69091
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...
CVE-2026-69090 Admidio before 5.0.11 Cross-Organization Role Modification
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...
