Veille CVE

Lundi 31 août 2026

3 CVE

Critique 0 Élevée 2 Moyenne 0 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « admidio » ✕
  1. CVE-2026-82657 7.5 Élevée

    admidio

    Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post text, author names, and timestamps.

  2. CVE-2026-82656 2.6 Faible

    admidio

    Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.

  3. CVE-2026-82655 7.5 Élevée

    admidio

    Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in role_list and inject SQL through relation_type_list to extract database contents including password hashes and user credentials.