CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS). |
| 28/06/2022 |
| CVE-2022-0991 | HIGH7.1 | Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. | 19/03/2022 |
| CVE-2021-43810 | MEDIUM6.1 | Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerabi | 07/12/2021 |
| CVE-2021-32630 | HIGH8.8 | Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Someone with upload permissions could rename the php shell with | 20/05/2021 |
| CVE-2020-11004 | HIGH7.5 | SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulner | 24/04/2020 |
| CVE-2017-8382 | MEDIUM4.5 | admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts. | 16/05/2017 |
| CVE-2017-6492 | HIGH7.2 | SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5. The POST parameter dat_cat_id is concatenated into a SQL query without any input validation/sanitization. | 05/03/2017 |
| CVE-2008-5209 | MEDIUM5.0 | Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. | 24/11/2008 |