Repository navigation
Security: Admidio/admidio
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
RSS feeds leak forum posts in login-only modeGHSA-mg9h-42f8-2pmm published
Aug 16, 2026 by FasseHigh -
Broken access control in profile_function.php leaks future membershipsGHSA-4p3x-3rxj-v7c4 published
Aug 16, 2026 by FasseModerate -
Role-Administrators Can Modify Roles Across Organizations via Missing Target-Organization CheckGHSA-fcq9-w4hp-xchg published
Jul 20, 2026 by FasseModerate -
Admidio Forum Module Login-Only Mode Authentication Bypass VulnerabilityGHSA-cf48-6jrq-gjcm published
Jul 20, 2026 by FasseModerate -
Reflected Cross-Site Scripting (XSS) in SSO/SAML Endpoint via Unencoded Exception MessagesGHSA-7jxv-38f3-6xgf published
Jul 20, 2026 by FasseModerate -
CSRF in Category Report preferences allows deleting or duplicating configurations via GETGHSA-mvx3-m6p6-7r9w published
Jul 20, 2026 by FasseModerate -
Admidio writes session IDs and auto-login cookie values to application logsGHSA-mch8-wf3h-6x88 published
May 25, 2026 by FasseModerate -
Admidio PKCS#12 private key export action lacks CSRF protectionGHSA-4rgq-38mh-9xqg published
May 25, 2026 by FasseModerate -
Any logged-in user can delete inventory fields via `modules/inventory.php` `mode=field_delete` — incomplete fix of #2024GHSA-xw54-c3mx-9pm3 published
May 25, 2026 by FasseModerate -
IDOR in `documents-files.php` `mode=file_rename_save` lets any folder-uploader rename or modify the description of files in folders they cannot upload toGHSA-q6w3-hpfv-rg36 published
May 25, 2026 by FasseModerate