admidio/admidio (Packagist)
Advisories
50
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.0.10 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require admidio/admidio:^5.0.10Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-hm42-q32m-vj4f Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests |
Medium EPSS 0.17% |
<= 5.0.11 | No fix yet |
| GHSA-xw54-c3mx-9pm3 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 |
Medium EPSS 0.31% |
< 5.0.10 | 5.0.10 |
| GHSA-mch8-wf3h-6x88 Admidio writes session IDs and auto-login cookie values to application logs |
Medium EPSS 0.17% |
< 5.0.10 | 5.0.10 |
| GHSA-4rgq-38mh-9xqg Admidio PKCS#12 private key export action lacks CSRF protection |
Medium EPSS 0.13% |
< 5.0.10 | 5.0.10 |
| GHSA-x628-457g-2pw9 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders |
High EPSS 0.35% |
< 5.0.10 | 5.0.10 |
| GHSA-q6w3-hpfv-rg36 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders |
Medium EPSS 0.30% |
< 5.0.10 | 5.0.10 |
| GHSA-xg76-5qj2-2hhv Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation |
Medium EPSS 0.14% |
< 5.0.10 | 5.0.10 |
| GHSA-mx25-j3rc-6w2w Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords |
Medium EPSS 0.16% |
< 5.0.10 | 5.0.10 |
| GHSA-rwjr-qjj3-mq2f Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php` |
Medium EPSS 0.33% |
< 5.0.10 | 5.0.10 |
| GHSA-qc4c-hrmc-4f78 Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges |
Medium EPSS 0.35% |
< 5.0.10 | 5.0.10 |
| GHSA-hcjj-chvw-fmw9 Admidio has an incomplete fix for CVE-2026-32812 (SSRF) |
Medium EPSS 0.24% |
< 5.0.9 | 5.0.9 |
| GHSA-9xx5-cv6j-x533 Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation |
Medium EPSS 0.32% |
< 5.0.9 | 5.0.9 |
| GHSA-p9w9-87c8-m235 Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest |
High EPSS 0.28% |
< 5.0.9 | 5.0.9 |
| GHSA-25cw-98hg-g3cg Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests |
High EPSS 0.19% |
< 5.0.9 | 5.0.9 |
| GHSA-rw74-vc9h-534j Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send |
Low EPSS 0.12% |
< 5.0.9 | 5.0.9 |
| GHSA-c7xm-r6vj-8vg6 Admidio Missing Minimum Administrator Check in Role Membership Removal |
Medium EPSS 0.29% |
< 5.0.9 | 5.0.9 |
| GHSA-gq27-fc8w-vcmp Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion |
Medium EPSS 0.18% |
< 5.0.9 | 5.0.9 |
| GHSA-rh3w-4ccx-prf9 Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP |
High EPSS 0.30% |
< 5.0.9 | 5.0.9 |
| GHSA-68pr-7prh-mpv4 Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment |
Low EPSS 0.26% |
< 5.0.9 | 5.0.9 |
| GHSA-xqv4-xm7h-52cv Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items |
Medium EPSS 0.24% |
< 5.0.9 | 5.0.9 |
| GHSA-g8p8-94f2-28gr Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php |
Medium EPSS 0.32% |
< 5.0.9 | 5.0.9 |
| GHSA-m9h6-8pqm-xrhf Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read |
Medium EPSS 0.36% |
< 5.0.9 | 5.0.9 |
| GHSA-m3vp-3jjm-gpmx Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials |
Medium EPSS 0.31% |
< 5.0.9 | 5.0.9 |
| GHSA-ph84-r98x-2j22 Admidio has Missing CSRF Protection on Registration Approval Actions |
High EPSS 0.18% |
< 5.0.8 | 5.0.8 |
| GHSA-4rwm-c5mj-wh7x Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter |
Low EPSS 0.14% |
< 5.0.8 | 5.0.8 |
| GHSA-g3mx-8jm6-rc85 Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php |
Medium EPSS 0.13% |
>= 5.0.0, < 5.0.8 | 5.0.8 |
| GHSA-7fh7-8xqm-3g88 Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess |
High EPSS 0.58% |
>= 5.0.0, < 5.0.8 | 5.0.8 |
| GHSA-3x67-4c2c-w45m Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter) |
High EPSS 0.29% |
< 5.0.7 | 5.0.7 |
| GHSA-g375-5wmp-xr78 Admidio is Missing Authorization on Forum Topic and Post Deletion |
Medium EPSS 0.24% |
>= 5.0.0, < 5.0.7 | 5.0.7 |
| GHSA-4wr4-f2qf-x5wj Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection |
Medium EPSS 0.23% |
< 5.0.7 | 5.0.7 |
| GHSA-rmpj-3x5m-9m5f Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion |
Critical EPSS 0.35% |
>= 5.0.0, < 5.0.7 | 5.0.7 |
| GHSA-6j68-gcc3-mq73 Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint |
Medium EPSS 0.44% |
>= 5.0.0, < 5.0.7 | 5.0.7 |
| GHSA-h8gr-qwr6-m9gx Admidio is Missing CSRF Protection on Role Membership Date Changes |
Medium EPSS 0.15% |
< 5.0.7 | 5.0.7 |
| GHSA-wwg8-6ffr-h4q2 Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions |
Medium EPSS 0.14% |
>= 5.0.0, < 5.0.7 | 5.0.7 |
| GHSA-95cq-p4w2-32w5 File Upload(RCE) Vulnerability in admidio |
High EPSS 1.02% |
< 5.0.7 | 5.0.7 |
| GHSA-7pfv-hr63-h7cw Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter |
Medium EPSS 0.27% |
< 5.0.6 | 5.0.6 |
| GHSA-2v5m-cq9w-fc33 Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality |
High EPSS 0.43% |
< 4.3.17 | 4.3.17 |
| GHSA-7c4c-749j-pfp2 Admidio Vulnerable to HTML Injection In The Messages Section |
Medium EPSS 0.51% |
< 4.3.12 | 4.3.12 |
| GHSA-g872-jwwr-vggm Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment |
High EPSS 1.24% |
< 4.3.10 | 4.3.10 |
| GHSA-69wx-xc6j-28v3 Admidio has Blind SQL Injection in ecard_send.php |
High EPSS 0.93% |
< 4.3.9 | 4.3.9 |
| GHSA-vm4p-gh82-xq96 Cross-site Scripting in Admidio |
Medium EPSS 0.70% |
< 4.2.13 | 4.2.13 |
| GHSA-qq8m-9rpx-w2fm Admidio Insufficient Session Expiration vulnerability |
Medium EPSS 0.60% |
< 4.2.11 | 4.2.11 |
| GHSA-q347-jrx8-5pw9 Admidio vulnerable to Unrestricted Upload of File with Dangerous Type |
High EPSS 1.01% |
< 4.2.10 | 4.2.10 |
| GHSA-x3m2-3pwj-8fj4 Admidio Improper Access Control vulnerability |
Medium EPSS 0.41% |
< 4.2.9 | 4.2.9 |
| GHSA-vmxg-wx6c-4f3r Admidio Improper Access Control vulnerability |
Low EPSS 0.42% |
< 4.2.9 | 4.2.9 |
| GHSA-hm75-8w6h-4f8f Admidio Improper Neutralization of Formula Elements in a CSV File vulnerability |
High EPSS 0.46% |
< 4.2.9 | 4.2.9 |
| GHSA-gx4r-fvwg-8678 Admidio vulnerable to Cross-site Scripting |
Medium EPSS 0.48% |
< 4.2.8 | 4.2.8 |
| GHSA-qr6m-f3gv-8678 Cross-site Scripting in admidio |
Medium EPSS 0.57% |
< 4.1.3 | 4.1.3 |
| GHSA-c4v8-2hg8-jv77 admidio CSRF Vulnerability |
Medium EPSS 2.63% |
< 4.1-Beta.1 | 4.1-Beta.1 |
| GHSA-mf79-f657-47ww Insufficient Session Expiration in Admidio |
High EPSS 1.01% |
< 4.1.9 | 4.1.9 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor