Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
73 results · page 2 of 2
Mar 19, 2026Admidio is an open-source user management solution.CVE-2026-32818 · Other software · Admidio · reported by GitHubMedium 6.5
Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in Admidio does not verify whether the current user has permission to delete forum topics or posts. Both the topic_delete and post_delete actions in forum.php only validate the CSRF token but perform no authorization check before calling delete(). Any authenticated user with forum access can delete any topic (with all its posts) or any individual post by providing its UUID. This is inconsistent with the save/edit operations, which properly check isAdministratorForum() and ownership before allowing modifications. Any logged-in user can permanently and irreversibly delete any forum topic (including all its posts) or any individual post by simply knowing its UUID (which is publicly visible in URLs), completely bypassing authorization checks. This issue has been fixed in version 5.0.7.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Admidio is an open-source user management solution.CVE-2026-32816 · Other software · Admidio · reported by GitHubMedium 5.7
Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/groups-roles/groups_roles.php perform destructive state changes on organizational roles but never validate an anti-CSRF token. The client-side UI passes a CSRF token to callUrlHideElement(), which includes it in the POST body, but the server-side handlers ignore $_POST["adm_csrf_token"] entirely for these three modes. An attacker who can discover a role UUID (visible in the public cards view when the module is publicly accessible) can embed a forged POST form on any external page and trick any user with the rol_assign_roles right into deleting or toggling roles for the organization. Role deletion is permanent and cascades to all memberships, event associations, and rights data. If exploited, an attacker can trick any user with delegated role-assignment rights into permanently deleting roles, mass-revoking all associated memberships and access to events, documents, and mailing lists, or silently activating or deactivating entire groups, with target role UUIDs trivially harvested from the unauthenticated public cards view and no undo path short of
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Admidio is an open-source user management solution.CVE-2026-32755 · Other software · Admidio · reported by GitHubMedium 5.7
Admidio is an open-source user management solution. In versions 5.0.6 and below, the save_membership action in modules/profile/profile_function.php saves changes to a member's role membership start and end dates but does not validate the CSRF token. The handler checks stop_membership and remove_former_membership against the CSRF token but omits save_membership from that check. Because membership UUIDs appear in the HTML source visible to authenticated users, an attacker can embed a crafted POST form on any external page and trick a role leader into submitting it, silently altering membership dates for any member of roles the victim leads. A role leader's session can be silently exploited via CSRF to manipulate any member's membership dates, terminating access by backdating, covertly extending unauthorized access, or revoking role-restricted features, all without confirmation, notification, or administrative approval. This issue has been fixed in version 5.0.7.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Admidio is an open-source user management solution.CVE-2026-30927 · Other software · Admidio · reported by GitHubMedium 5.3
Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter. The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user. The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than the current user. This vulnerability is fixed in 5.0.6.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Admidio is an open-source user management solution.CVE-2025-62617 · Other software · Admidio · reported by GitHubHigh 7.2
Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 4.3.17.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024Admidio is an open-source user management solution.CVE-2024-47836 · Other software · Admidio · reported by GitHubLow 3.5
Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024Admidio is a free, open source user management system for websites of organizations and groups.CVE-2024-38529 · Other software · Admidio · reported by GitHubCritical 9
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL `{admidio_base_url}/adm_my_files/messages_attachments/{file_name}`. The vulnerability is caused due to the lack of file extension verification, allowing malicious files to be uploaded to the server and public availability of the uploaded file. This vulnerability is fixed in 4.3.10.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024Admidio is a free, open source user management system for websites of organizations and groups.CVE-2024-37906 · Other software · Admidio · reported by GitHubCritical 9.9
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2023Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS).CVE-2023-47380 · Other software · Admidio · reported by MITREMedium 6.1
Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS).
- Product
- Admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.CVE-2023-4190 · Other software · admidio · reported by security@huntr.devMedium 6.5
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2023Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.CVE-2023-3692 · Other software · admidio · reported by security@huntr.devHigh 7.2
Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3304 · Other software · admidio · reported by security@huntr.devMedium 5.4
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3303 · Other software · admidio · reported by security@huntr.devLow 3.5
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3302 · Other software · admidio · reported by security@huntr.devHigh 7.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8.CVE-2023-3109 · Other software · admidio · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).CVE-2022-23896 · Other software · Admidio · reported by MITREMedium 5.4
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
- Product
- Admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2022Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.CVE-2022-0991 · Other software · admidio · reported by security@huntr.devHigh 7.1
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021Admidio is a free open source user management system for websites of organizations and groups.CVE-2021-43810 · Other software · Admidio · reported by GitHubHigh 8.8
Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2021Admidio is a free, open source user management system for websites of organizations and groups.CVE-2021-32630 · Other software · Admidio · reported by GitHubCritical 9.6
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Someone with upload permissions could rename the php shell with a .phar extension, visit the file, triggering the payload for a reverse/bind shell. This can be mitigated by excluding a .phar file extension to be uploaded (like you did with .php .phtml .php5 etc). The vulnerability is patched in version 4.0.4.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2020SQL Injection was discovered in Admidio before version 3.3.13.CVE-2020-11004 · Other software · Admidio · reported by GitHubHigh 7.7
SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2017admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.CVE-2017-8382 · Other software · Admidio · reported by MITREMedium 4.5
admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.
- Product
- Admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.0day.todaygithub.com
Mar 5, 2017SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5.CVE-2017-6492 · Other software · Admidio · reported by MITREHigh 7.2
SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5. The POST parameter dat_cat_id is concatenated into a SQL query without any input validation/sanitization.
- Product
- Admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Nov 24, 2008Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a ..CVE-2008-5209 · Other software · Admidio · reported by MITREMedium 5
Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
- Product
- Admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.