{"schema_version":1,"title":"admidio/admidio (Packagist) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 50 vulnerabilities in admidio/admidio (Packagist): 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-53760, was published on 4 September 2026.","url":"https://junglewise.ai/threats/technologies/admidio-admidio","json_url":"https://junglewise.ai/threats/technologies/admidio-admidio.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/admidio-admidio","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":50,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":1,"last_365_days":37},"latest":[{"cve":"CVE-2026-53760","cvss":5.2,"epss":0.0017,"slug":"cve-2026-53760-admidio-csrf-in-plugin-management-module","title":"Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installati","severity":"medium","exploited":false,"published_at":"2026-09-04T18:17:52.77+00:00","url":"https://junglewise.ai/threats/cve-2026-53760-admidio-csrf-in-plugin-management-module"},{"cve":"CVE-2026-47233","cvss":6.5,"epss":0.0031,"slug":"cve-2026-47233-admidio-unauthorized-inventory-field-deletion-in-inventory-module","title":"Admidio unauthorized inventory field deletion in inventory module","severity":"medium","exploited":false,"published_at":"2026-05-29T22:09:38+00:00","url":"https://junglewise.ai/threats/cve-2026-47233-admidio-unauthorized-inventory-field-deletion-in-inventory-module"},{"cve":"CVE-2026-47234","cvss":4.4,"epss":0.0017,"slug":"cve-2026-47234-admidio-sensitive-information-disclosure-in-application-logs","title":"Admidio sensitive information disclosure in application logs","severity":"medium","exploited":false,"published_at":"2026-05-29T22:07:52+00:00","url":"https://junglewise.ai/threats/cve-2026-47234-admidio-sensitive-information-disclosure-in-application-logs"},{"cve":"CVE-2026-47232","cvss":4.3,"epss":0.0013,"slug":"cve-2026-47232-admidio-csrf-in-pkcs-12-private-key-export","title":"Admidio CSRF in PKCS#12 private key export","severity":"medium","exploited":false,"published_at":"2026-05-29T22:07:24+00:00","url":"https://junglewise.ai/threats/cve-2026-47232-admidio-csrf-in-pkcs-12-private-key-export"},{"cve":"CVE-2026-47231","cvss":8.1,"epss":0.0035,"slug":"cve-2026-47231-admidio-idor-in-documents-files-php-move-save-handler","title":"Admidio IDOR in documents-files.php move_save handler","severity":"high","exploited":false,"published_at":"2026-05-29T22:06:48+00:00","url":"https://junglewise.ai/threats/cve-2026-47231-admidio-idor-in-documents-files-php-move-save-handler"},{"cve":"CVE-2026-47230","cvss":6.5,"epss":0.003,"slug":"cve-2026-47230-admidio-idor-in-documents-files-php-allows-unauthorized-file","title":"Admidio IDOR in documents-files.php allows unauthorized file renaming","severity":"medium","exploited":false,"published_at":"2026-05-29T22:05:47+00:00","url":"https://junglewise.ai/threats/cve-2026-47230-admidio-idor-in-documents-files-php-allows-unauthorized-file"},{"cve":"CVE-2026-47229","cvss":5.4,"epss":0.0014,"slug":"cve-2026-47229-admidio-csrf-in-sso-client-enable-action","title":"Admidio CSRF in SSO client enable action","severity":"medium","exploited":false,"published_at":"2026-05-29T22:01:58+00:00","url":"https://junglewise.ai/threats/cve-2026-47229-admidio-csrf-in-sso-client-enable-action"},{"cve":"CVE-2026-47228","cvss":5.2,"epss":0.0016,"slug":"cve-2026-47228-admidio-csrf-password-reset-in-registration-module","title":"Admidio CSRF password reset in registration module","severity":"medium","exploited":false,"published_at":"2026-05-29T21:58:44+00:00","url":"https://junglewise.ai/threats/cve-2026-47228-admidio-csrf-password-reset-in-registration-module"},{"cve":"CVE-2026-47227","cvss":6.5,"epss":0.0033,"slug":"cve-2026-47227-admidio-broken-authorization-in-category-management","title":"Admidio broken authorization in category management","severity":"medium","exploited":false,"published_at":"2026-05-29T21:57:05+00:00","url":"https://junglewise.ai/threats/cve-2026-47227-admidio-broken-authorization-in-category-management"},{"cve":"CVE-2026-47226","cvss":6.5,"epss":0.0035,"slug":"cve-2026-47226-admidio-authorization-bypass-in-file-delete-handler","title":"Admidio authorization bypass in file_delete handler","severity":"medium","exploited":false,"published_at":"2026-05-29T21:54:09+00:00","url":"https://junglewise.ai/threats/cve-2026-47226-admidio-authorization-bypass-in-file-delete-handler"},{"cve":"CVE-2026-42194","cvss":3.1,"epss":0.0039,"slug":"cve-2026-42194-admidio-has-an-incomplete-fix-for-ssrf","title":"Admidio has an incomplete fix for (SSRF)","severity":"low","exploited":false,"published_at":"2026-05-05T20:03:46+00:00","url":"https://junglewise.ai/threats/cve-2026-42194-admidio-has-an-incomplete-fix-for-ssrf"},{"cve":"CVE-2026-41671","cvss":3.1,"epss":0.0043,"slug":"cve-2026-41671-admidio-oidc-token-introspection-endpoint-returns-active-for-all","title":"Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation","severity":"low","exploited":false,"published_at":"2026-04-29T21:58:56+00:00","url":"https://junglewise.ai/threats/cve-2026-41671-admidio-oidc-token-introspection-endpoint-returns-active-for-all"},{"cve":"CVE-2026-41670","cvss":3.1,"epss":0.0031,"slug":"cve-2026-41670-admidio-sends-saml-response-to-unvalidated-assertion-consumer","title":"Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest","severity":"low","exploited":false,"published_at":"2026-04-29T21:57:30+00:00","url":"https://junglewise.ai/threats/cve-2026-41670-admidio-sends-saml-response-to-unvalidated-assertion-consumer"},{"cve":"CVE-2026-41669","cvss":3.1,"epss":0.0022,"slug":"cve-2026-41669-admidio-ignores-saml-signature-validation-result-processes-forged","title":"Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests","severity":"low","exploited":false,"published_at":"2026-04-29T21:56:13+00:00","url":"https://junglewise.ai/threats/cve-2026-41669-admidio-ignores-saml-signature-validation-result-processes-forged"},{"cve":"CVE-2026-41663","cvss":3.1,"epss":0.0014,"slug":"cve-2026-41663-admidio-has-csrf-on-admin-preferences-that-triggers-unauthorized","title":"Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send","severity":"low","exploited":false,"published_at":"2026-04-29T21:54:30+00:00","url":"https://junglewise.ai/threats/cve-2026-41663-admidio-has-csrf-on-admin-preferences-that-triggers-unauthorized"},{"cve":"CVE-2026-41662","cvss":3.1,"epss":0.0037,"slug":"cve-2026-41662-admidio-missing-minimum-administrator-check-in-role-membership","title":"Admidio Missing Minimum Administrator Check in Role Membership Removal","severity":"low","exploited":false,"published_at":"2026-04-29T21:53:20+00:00","url":"https://junglewise.ai/threats/cve-2026-41662-admidio-missing-minimum-administrator-check-in-role-membership"},{"cve":"CVE-2026-41661","cvss":3.1,"epss":0.0029,"slug":"cve-2026-41661-admidio-vulnerable-to-reflected-xss-in-msg-window-php-via-square","title":"Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion","severity":"low","exploited":false,"published_at":"2026-04-29T21:51:13+00:00","url":"https://junglewise.ai/threats/cve-2026-41661-admidio-vulnerable-to-reflected-xss-in-msg-window-php-via-square"},{"cve":"CVE-2026-41660","cvss":3.1,"epss":0.0044,"slug":"cve-2026-41660-admidio-has-inverted-2fa-reset-authorization-check-that-lets","title":"Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP","severity":"low","exploited":false,"published_at":"2026-04-29T21:49:24+00:00","url":"https://junglewise.ai/threats/cve-2026-41660-admidio-has-inverted-2fa-reset-authorization-check-that-lets"},{"cve":"CVE-2026-41659","cvss":3.1,"epss":0.0033,"slug":"cve-2026-41659-admidio-leaks-hidden-profile-field-values-via-blind-search-oracle","title":"Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment","severity":"low","exploited":false,"published_at":"2026-04-29T21:47:29+00:00","url":"https://junglewise.ai/threats/cve-2026-41659-admidio-leaks-hidden-profile-field-values-via-blind-search-oracle"},{"cve":"CVE-2026-41658","cvss":3.1,"epss":0.0031,"slug":"cve-2026-41658-admidio-s-missing-authorization-on-inventory-module-destructive","title":"Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items","severity":"low","exploited":false,"published_at":"2026-04-29T21:46:23+00:00","url":"https://junglewise.ai/threats/cve-2026-41658-admidio-s-missing-authorization-on-inventory-module-destructive"},{"cve":"CVE-2026-41657","cvss":3.1,"epss":0.0042,"slug":"cve-2026-41657-admidio-exposes-cross-organization-member-data-via-permission","title":"Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php","severity":"low","exploited":false,"published_at":"2026-04-29T21:44:24+00:00","url":"https://junglewise.ai/threats/cve-2026-41657-admidio-exposes-cross-organization-member-data-via-permission"},{"cve":"CVE-2026-41656","cvss":3.1,"epss":0.0043,"slug":"cve-2026-41656-admidio-has-path-traversal-via-unvalidated-name-parameter-in","title":"Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read","severity":"low","exploited":false,"published_at":"2026-04-29T21:42:20+00:00","url":"https://junglewise.ai/threats/cve-2026-41656-admidio-has-path-traversal-via-unvalidated-name-parameter-in"},{"cve":"CVE-2026-41655","cvss":3.1,"epss":0.0046,"slug":"cve-2026-41655-admidio-has-path-traversal-in-ecard-preview-that-allows-reading","title":"Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials","severity":"low","exploited":false,"published_at":"2026-04-29T21:37:23+00:00","url":"https://junglewise.ai/threats/cve-2026-41655-admidio-has-path-traversal-in-ecard-preview-that-allows-reading"},{"cve":"CVE-2026-34384","cvss":4.5,"epss":0.0019,"slug":"cve-2026-34384-admidio-csrf-in-registration-approval-actions","title":"Admidio CSRF in registration approval actions","severity":"medium","exploited":false,"published_at":"2026-03-31T21:16:30.503+00:00","url":"https://junglewise.ai/threats/cve-2026-34384-admidio-csrf-in-registration-approval-actions"},{"cve":"CVE-2026-34383","cvss":4.3,"epss":0.0015,"slug":"cve-2026-34383-admidio-csrf-and-validation-bypass-in-inventory-module","title":"Admidio CSRF and validation bypass in inventory module","severity":"medium","exploited":false,"published_at":"2026-03-31T21:16:30.343+00:00","url":"https://junglewise.ai/threats/cve-2026-34383-admidio-csrf-and-validation-bypass-in-inventory-module"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"wwbn/avideo (Packagist)","slug":"wwbn-avideo","vulnerabilities":169,"url":"https://junglewise.ai/threats/technologies/wwbn-avideo"},{"name":"getgrav/grav (Packagist)","slug":"getgrav-grav","vulnerabilities":144,"url":"https://junglewise.ai/threats/technologies/getgrav-grav"},{"name":"thorsten/phpmyfaq (Packagist)","slug":"thorsten-phpmyfaq","vulnerabilities":138,"url":"https://junglewise.ai/threats/technologies/thorsten-phpmyfaq"},{"name":"pimcore/pimcore (Packagist)","slug":"pimcore-pimcore","vulnerabilities":136,"url":"https://junglewise.ai/threats/technologies/pimcore-pimcore"},{"name":"dolibarr/dolibarr (Packagist)","slug":"dolibarr-dolibarr","vulnerabilities":125,"url":"https://junglewise.ai/threats/technologies/dolibarr-dolibarr"},{"name":"drupal/core (Packagist)","slug":"packagist-drupal-core","vulnerabilities":116,"url":"https://junglewise.ai/threats/technologies/packagist-drupal-core"},{"name":"librenms/librenms (Packagist)","slug":"librenms-librenms","vulnerabilities":113,"url":"https://junglewise.ai/threats/technologies/librenms-librenms"},{"name":"microweber/microweber (Packagist)","slug":"microweber-microweber","vulnerabilities":106,"url":"https://junglewise.ai/threats/technologies/microweber-microweber"},{"name":"concrete5/concrete5 (Packagist)","slug":"concrete5-concrete5","vulnerabilities":93,"url":"https://junglewise.ai/threats/technologies/concrete5-concrete5"},{"name":"craftcms/cms (Packagist)","slug":"craftcms-cms","vulnerabilities":90,"url":"https://junglewise.ai/threats/technologies/craftcms-cms"},{"name":"snipe/snipe-it (Packagist)","slug":"snipe-snipe-it","vulnerabilities":80,"url":"https://junglewise.ai/threats/technologies/snipe-snipe-it"},{"name":"phpmyfaq/phpmyfaq (Packagist)","slug":"phpmyfaq-phpmyfaq","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq"}],"technology":{"hub":true,"name":"admidio/admidio (Packagist)","slug":"admidio-admidio","vendor":{"name":"Packagist","slug":"packagist","url":"https://junglewise.ai/threats/vendors/packagist"},"aliases":[],"homepage":"https://www.admidio.org/","repo_url":"https://github.com/Admidio/admidio","description":"Admidio is an open-source user management system for local groups, organizations, and societies.","url":"https://junglewise.ai/threats/technologies/admidio-admidio"},"most_severe":[{"cve":"CVE-2026-47231","cvss":8.1,"epss":0.0035,"slug":"cve-2026-47231-admidio-idor-in-documents-files-php-move-save-handler","title":"Admidio IDOR in documents-files.php move_save handler","severity":"high","exploited":false,"published_at":"2026-05-29T22:06:48+00:00","url":"https://junglewise.ai/threats/cve-2026-47231-admidio-idor-in-documents-files-php-move-save-handler"},{"cve":"CVE-2026-34381","cvss":7.5,"epss":0.0052,"slug":"cve-2026-34381-admidio-improper-access-control-in-docker-image-document-storage","title":"Admidio improper access control in Docker image document storage","severity":"high","exploited":false,"published_at":"2026-03-31T21:16:30.013+00:00","url":"https://junglewise.ai/threats/cve-2026-34381-admidio-improper-access-control-in-docker-image-document-storage"},{"cve":"CVE-2026-47226","cvss":6.5,"epss":0.0035,"slug":"cve-2026-47226-admidio-authorization-bypass-in-file-delete-handler","title":"Admidio authorization bypass in file_delete handler","severity":"medium","exploited":false,"published_at":"2026-05-29T21:54:09+00:00","url":"https://junglewise.ai/threats/cve-2026-47226-admidio-authorization-bypass-in-file-delete-handler"},{"cve":"CVE-2026-47227","cvss":6.5,"epss":0.0033,"slug":"cve-2026-47227-admidio-broken-authorization-in-category-management","title":"Admidio broken authorization in category management","severity":"medium","exploited":false,"published_at":"2026-05-29T21:57:05+00:00","url":"https://junglewise.ai/threats/cve-2026-47227-admidio-broken-authorization-in-category-management"},{"cve":"CVE-2026-47233","cvss":6.5,"epss":0.0031,"slug":"cve-2026-47233-admidio-unauthorized-inventory-field-deletion-in-inventory-module","title":"Admidio unauthorized inventory field deletion in inventory module","severity":"medium","exploited":false,"published_at":"2026-05-29T22:09:38+00:00","url":"https://junglewise.ai/threats/cve-2026-47233-admidio-unauthorized-inventory-field-deletion-in-inventory-module"},{"cve":"CVE-2026-47230","cvss":6.5,"epss":0.003,"slug":"cve-2026-47230-admidio-idor-in-documents-files-php-allows-unauthorized-file","title":"Admidio IDOR in documents-files.php allows unauthorized file renaming","severity":"medium","exploited":false,"published_at":"2026-05-29T22:05:47+00:00","url":"https://junglewise.ai/threats/cve-2026-47230-admidio-idor-in-documents-files-php-allows-unauthorized-file"},{"cve":"CVE-2026-47229","cvss":5.4,"epss":0.0014,"slug":"cve-2026-47229-admidio-csrf-in-sso-client-enable-action","title":"Admidio CSRF in SSO client enable action","severity":"medium","exploited":false,"published_at":"2026-05-29T22:01:58+00:00","url":"https://junglewise.ai/threats/cve-2026-47229-admidio-csrf-in-sso-client-enable-action"},{"cve":"CVE-2026-53760","cvss":5.2,"epss":0.0017,"slug":"cve-2026-53760-admidio-csrf-in-plugin-management-module","title":"Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installati","severity":"medium","exploited":false,"published_at":"2026-09-04T18:17:52.77+00:00","url":"https://junglewise.ai/threats/cve-2026-53760-admidio-csrf-in-plugin-management-module"},{"cve":"CVE-2026-47228","cvss":5.2,"epss":0.0016,"slug":"cve-2026-47228-admidio-csrf-password-reset-in-registration-module","title":"Admidio CSRF password reset in registration module","severity":"medium","exploited":false,"published_at":"2026-05-29T21:58:44+00:00","url":"https://junglewise.ai/threats/cve-2026-47228-admidio-csrf-password-reset-in-registration-module"},{"cve":"CVE-2026-34382","cvss":4.6,"epss":0.0014,"slug":"cve-2026-34382-admidio-csrf-in-mylist-function-php-list-deletion","title":"Admidio CSRF in mylist_function.php list deletion","severity":"medium","exploited":false,"published_at":"2026-03-31T21:16:30.18+00:00","url":"https://junglewise.ai/threats/cve-2026-34382-admidio-csrf-in-mylist-function-php-list-deletion"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}