{"kind": "product", "path": "vulns/packagist/admidio%2Fadmidio", "name": "admidio/admidio", "product": "admidio/admidio", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-53760", "noindex": false, "published": "2026-09-04T17:54:40.136Z", "modified": "2026-09-09T16:00:19.987Z", "cvss": 5.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L", "severity": "medium", "epss": 0.00167, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-53760", "title": "Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests", "description": "Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an authenticated administrator visits it, triggers arbitrary plugin operations. The uninstall operation executes DROP TABLE SQL scripts and destroys plugin data. This issue has been patched via commit 056b1bd.", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-hm42-q32m-vj4f", "https://github.com/Admidio/admidio/commit/056b1bd9f995437395e337d2c73a32e5c96ee616", "https://nvd.nist.gov/vuln/detail/CVE-2026-53760"], "fixes": [], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47234", "noindex": false, "published": "2026-08-12T13:58:11.339Z", "modified": "2026-08-12T22:12:32.459Z", "cvss": 4.4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47234", "title": "Admidio writes session IDs and auto-login cookie values to application logs", "description": "Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-mch8-wf3h-6x88", "https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L533-L540", "https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L615-L617"], "fixes": ["5.0.10"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47233", "noindex": false, "published": "2026-08-12T13:57:14.510Z", "modified": "2026-08-13T16:17:53.128Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00311, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47233", "title": "Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024", "description": "Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\\Inventory\\Entity\\ItemField::delete()` does not enforce one at the entity level either (un", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-xw54-c3mx-9pm3", "https://github.com/Admidio/admidio/commit/d37ca6b27b9674238e58491cf7ba292e66898f15", "https://nvd.nist.gov/vuln/detail/CVE-2026-47233"], "fixes": ["5.0.10"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47232", "noindex": false, "published": "2026-08-12T13:18:55.507Z", "modified": "2026-08-12T13:32:17.252Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00132, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47232", "title": "Admidio PKCS#12 private key export action lacks CSRF protection", "description": "Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token. Version 5.0.10 contains a fix.", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-4rgq-38mh-9xqg", "https://github.com/Admidio/admidio/blob/v5.0.9/modules/sso/keys.php#L83-L94", "https://github.com/Admidio/admidio/blob/v5.0.9/src/SSO/Service/KeyService.php#L108-L150"], "fixes": ["5.0.10"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47231", "noindex": false, "published": "2026-08-12T13:17:16.419Z", "modified": "2026-08-12T15:20:40.000Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.0035, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47231", "title": "Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders", "description": "Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on the destination folder but never on the source folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder — including private folders to which they have no view rights — into a folder ", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-x628-457g-2pw9", "https://nvd.nist.gov/vuln/detail/CVE-2026-47231"], "fixes": ["5.0.10"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47230", "noindex": false, "published": "2026-08-12T13:14:37.914Z", "modified": "2026-08-12T22:12:39.908Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00299, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47230", "title": "Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders", "description": "Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder move bug (`05-documents-cross-folder-move-idor.md`): the top-level rights check at lines 79-89 validates `hasUploadRight()` on the URL parameter `folder_uuid`, but the rename operation acts on `file_uuid` — a separate URL parameter — without re-checking the folder that actually contains the file. `DocumentsService::renameFile()` resolves the target file via `getFileForDownload()` (which permits view-readable files) but does not require upload right on the file's", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-q6w3-hpfv-rg36", "https://nvd.nist.gov/vuln/detail/CVE-2026-47230"], "fixes": ["5.0.10"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47229", "noindex": false, "published": "2026-08-12T13:11:31.073Z", "modified": "2026-08-13T16:01:59.124Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00138, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47229", "title": "Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation", "description": "Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it. Version 5.0.10 contains a fix", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-xg76-5qj2-2hhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-47229"], "fixes": ["5.0.10"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47228", "noindex": false, "published": "2026-08-12T13:09:18.463Z", "modified": "2026-08-12T13:32:55.509Z", "cvss": 5.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L", "severity": "medium", "epss": 0.00161, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47228", "title": "Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords", "description": "Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other state-changing mode in the same file (`assign_member`, `assign_user`, `delete_user`, `create_user`) calls `SecurityUtils::validateCsrfToken($_POST['adm_csrf_token'])` first; the `send_login` branch does not. Prior to version 5.0.10, page visited by a registration-administrator can issue the request as a top-level navigation, the browser sends the admin's `SameSite=Lax` cookies, and the serve", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-mx25-j3rc-6w2w", "https://nvd.nist.gov/vuln/detail/CVE-2026-47228"], "fixes": ["5.0.10"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47227", "noindex": false, "published": "2026-08-12T12:58:29.719Z", "modified": "2026-08-12T15:23:07.680Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00326, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47227", "title": "Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`", "description": "Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module the actor administers. The follow-up \"is this specific category editable by me\" check at lines 56-61 is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`); the condition is permanently false, so `$category->isEditable()` is never invoked. Prior to version 5.0.10, the `delete`, `sequence`, and `save` switch cases load the category by the supplied UUID and act on it without re-checking that the category belongs to a ", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-rwjr-qjj3-mq2f", "https://nvd.nist.gov/vuln/detail/CVE-2026-47227"], "fixes": ["5.0.10"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47226", "noindex": false, "published": "2026-08-12T12:51:24.034Z", "modified": "2026-08-12T22:12:48.586Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00348, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47226", "title": "Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges", "description": "Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter — not the file's actual parent folder. The `file_delete` handler then only verifies view rights on the file's real location, never upload rights. By passing a folder they legitimately own in `folder_uuid` while targeting a file in a restricted folder via `file_uuid`, an attacke", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-qc4c-hrmc-4f78", "https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f", "https://nvd.nist.gov/vuln/detail/CVE-2026-47226"], "fixes": ["5.0.10"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-42194", "noindex": false, "published": "2026-05-07T03:01:04.830Z", "modified": "2026-05-07T14:58:33.152Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00236, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-42194", "title": "Incomplete fix for CVE-2026-32812: SSRF in admidio", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs. This issue has been patched in version 5.0.9.", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-hcjj-chvw-fmw9", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-42194"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41671", "noindex": false, "published": "2026-05-07T03:00:55.645Z", "modified": "2026-05-07T12:46:28.521Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "severity": "medium", "epss": 0.00323, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41671", "title": "Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modules/sso/index.php/oidc/introspect) always returns {\"active\": true} for every request, regardless of whether a valid token is provided, whether the token is expired, revoked, or completely fabricated. The endpoint performs no authentication of the calling resource server and no validation of the submitted token. Any resource server that relies on this introspection endpoint to validate access tokens will accept all requests as authorized, enabling complete authentication bypass. Additionally, the OIDC token revocation endpoin", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-9xx5-cv6j-x533", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-41671"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41670", "noindex": false, "published": "2026-05-07T03:00:39.851Z", "modified": "2026-05-07T13:44:01.169Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.0028, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41670", "title": "Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServiceURL value directly from incoming SAML AuthnRequest messages as the destination for the SAML response, without validating it against the registered ACS URL (smc_acs_url) stored in the database for the corresponding service provider client. An attacker who knows the Entity ID of a registered SP client can craft a SAML AuthnRequest with an arbitrary AssertionConsumerServiceURL, causing the IdP to send the signed SAML response -- containing user identity attributes (login name, email, rol", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-p9w9-87c8-m235", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-41670"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41669", "noindex": false, "published": "2026-05-07T03:00:29.816Z", "modified": "2026-05-07T13:52:49.029Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00191, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41669", "title": "Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio SAML Identity Provider implementation discards the return value of its validateSignature() method at both call sites (handleSSORequest() line 418 and handleSLORequest() line 613). The method returns error strings on failure rather than throwing exceptions, but the developer believed it would throw (per comments on lines 416 and 611). This means the smc_require_auth_signed configuration option is completely ineffective — unsigned or invalidly-signed SAML AuthnRequests and LogoutRequests are processed identically to properly signed ones. This issue has been ", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-25cw-98hg-g3cg", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-41669"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41663", "noindex": false, "published": "2026-05-07T03:00:11.696Z", "modified": "2026-05-07T12:41:41.736Z", "cvss": 3.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L", "severity": "low", "epss": 0.00117, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41663", "title": "Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio's preferences module (database backup, test email, htaccess generation) fire via GET requests with no CSRF token validation. Because SameSite=Lax cookies travel with top-level GET navigations, an attacker forces an authenticated admin to trigger these actions from a malicious page. This issue has been patched in version 5.0.9.", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-rw74-vc9h-534j", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-41663"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41662", "noindex": false, "published": "2026-05-07T02:59:50.508Z", "modified": "2026-05-07T14:06:48.349Z", "cvss": 5.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H", "severity": "medium", "epss": 0.00285, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41662", "title": "Admidio: Missing Minimum Administrator Check in Role Membership Removal", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify whether removing a user from the administrator role leaves zero administrators. The deprecated Membership::stopMembership() contains this safety check, but the current code path bypasses it. Any administrator can remove the last remaining other administrator, locking the entire system out of administrative access. The exploit does not require concurrent requests; sequential removals produce the same result. This issue has been patched in version 5.0.9.", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-c7xm-r6vj-8vg6", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-41662"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41661", "noindex": false, "published": "2026-05-07T02:59:34.649Z", "modified": "2026-05-07T14:58:41.314Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00181, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41661", "title": "Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, an unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's browser through a reflected XSS in system/msg_window.php. The endpoint passes user input through htmlspecialchars(), which does not encode square brackets. A subsequent call to Language::prepareTextPlaceholders() converts those brackets into HTML angle brackets, producing executable markup. This issue has been patched in version 5.0.9.", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-gq27-fc8w-vcmp", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-41661"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41660", "noindex": false, "published": "2026-05-07T02:59:29.810Z", "modified": "2026-05-07T12:44:52.834Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "severity": "high", "epss": 0.00297, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41660", "title": "Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users cannot remove their own TOTP configuration, but they can remove other users' TOTP, including administrators. A group leader with profile edit rights on an admin account can strip that admin's 2FA. This issue has been patched in version 5.0.9.", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-rh3w-4ccx-prf9", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-41660"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41659", "noindex": false, "published": "2026-05-07T02:59:19.870Z", "modified": "2026-05-07T13:44:42.872Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00258, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41659", "title": "Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_data.php) includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible() checks, the server-side search operates at the SQL level before any visibility filtering. This allows a role leader with assign-only permissions to infer hidden PII values by observing which users appear in search results for specific values. This issue has been patched in version 5.", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-68pr-7prh-mpv4", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-41659"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41658", "noindex": false, "published": "2026-05-07T02:58:27.557Z", "modified": "2026-05-07T13:56:16.154Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.0024, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41658", "title": "Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items", "description": "Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (delete, retire, reinstate) only in the UI layer by conditionally rendering buttons. The backend POST handlers at modules/inventory.php for item_delete, item_retire, item_reinstate, item_picture_upload, item_picture_save, and item_picture_delete perform CSRF validation but never check whether the requesting user is an inventory administrator. Any authenticated user who can access the inventory module can permanently delete any inventory item and all its associated data. This issue has been ", "references": ["https://github.com/Admidio/admidio/security/advisories/GHSA-xqv4-xm7h-52cv", "https://github.com/Admidio/admidio/releases/tag/v5.0.9", "https://nvd.nist.gov/vuln/detail/CVE-2026-41658"], "fixes": ["5.0.9"], "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}]}], "total": 50, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "admidio/admidio", "path": "vulns/packagist/admidio%2Fadmidio", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["5.0.10", "5.0.9", "5.0.8", "5.0.7", "5.0.6", "4.3.17", "4.3.12", "4.3.10", "4.3.9", "4.2.13", "4.2.11", "4.2.10"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-09T16:00:19.987Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}