A
Vendor security profile
admidio
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs26
Critical0
CISA KEV0
Public exploit18
Patch rate%19
Avg. CVSS6.2
12-month vulnerability rate
0
0
0
0
4
0
0
0
0
18
1
3
CVE KEV
CVE severity distribution
26toplam CVE
High8 (31%)
Medium16 (62%)
Low2 (8%)
Patch and exploitation view
%19
Verified patch
%0
CISA KEV
%69
Public exploit
5Patch available
0Partial
1Workaround
0Vendor: no patch
20Unknown
Latest vulnerabilities
8.5
CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php
A
Patch status unknownEPSS %0
5.3
CVE-2026-109328
Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name
A
Patch status unknownEPSS %0
5.1
CVE-2026-109327
Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php
A
Patch status unknownEPSS %0
5.2
CVE-2026-53760
Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
A
WorkaroundEPSS %0
5.3
CVE-2026-82658
Admidio before 5.0.12 Broken Access Control via profile_function.php
A
Patch status unknownEPSS %0
8.7
CVE-2026-82657
Admidio before 5.0.12 Authentication Bypass via RSS feeds
A
Patch status unknownEPSS %0
2.1
CVE-2026-82656
Admidio before 5.0.12 Path Traversal via Photo ZIP Download
A
Patch status unknownEPSS %0
8.7
CVE-2026-82655
Admidio before 5.0.12 SQL Injection via relation_type_list
A
Patch status unknownEPSS %1
4.4
CVE-2026-47234
Admidio writes session IDs and auto-login cookie values to application logs
A
Patch status unknownEPSS %0
6.5
CVE-2026-47233
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
A
Patch status unknownEPSS %0