These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2018-25370 documents a cross-site request forgery (CSRF) vulnerability in Admidio 3.3.5 that enables low-privilege users to escalate their permissions. The flaw resides in improper origin checking within roles_function.php, allowing attackers to craft malicious HTML forms that set role parameters (rol_assign_roles, rol_approve_users, rol_edit_user) to 1 without requiring authentication. The vulnerabil [truncated]
CVE-2026-34384 is a vulnerability in Admidio, an open-source user management solution. Prior to version 5.0.8, the create_user, assign_member, and assign_user action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. This allows an attacker who has submitted a pending registration to trick any user with the rol_approve_users right into vis [truncated]
CVE-2026-34382 is a medium-severity vulnerability affecting Admidio, an open-source user management solution, versions 5.0.0 through 5.0.7. The vulnerability allows an attacker to permanently delete list configurations without proper CSRF validation, potentially impacting organization-wide shared lists if an administrator is tricked into visiting a malicious page. This issue has significant implications f [truncated]
CVE-2026-34381 is a high-severity vulnerability in Admidio versions 5.0.0 to 5.0.7. The issue arises from Admidio's reliance on .htaccess to restrict direct HTTP access to uploaded documents. However, the Docker image is configured with 'AllowOverride None' in Apache, causing .htaccess files to be ignored. Consequently, files uploaded to the documents module can be accessed directly via HTTP without authe [truncated]
CVE-2017-6492 describes a SQL injection vulnerability in Admidio 3.2.5 affecting the dates_function.php code path. The issue is caused by concatenating the POST parameter dat_cat_id directly into a SQL query without input validation or sanitization. NVD rates the issue as CVSS 3.0 7.2 (HIGH) and maps it to CWE-89.