Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API

CVE-2026-42137

### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access or l

历史摘要 · 未重新核验 · GitHub Advisory

ps_checkout allows unauthorized method invocation through unvalidated parameter

### Impact Unvalidated parameter can lead to some unauthorized method invocation with very little possibilities. ### P

历史摘要 · 未重新核验 · GitHub Advisory

Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation

CVE-2026-41671

## Summary The OIDC token introspection endpoint (`/modules/sso/index.php/oidc/introspect`) always returns `{"active":

历史摘要 · 未重新核验 · GitHub Advisory

Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest

CVE-2026-41670

## Summary The SAML IdP implementation in Admidio's SSO module uses the `AssertionConsumerServiceURL` value directly fr

历史摘要 · 未重新核验 · GitHub Advisory

Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests

CVE-2026-41669

## Summary The Admidio SAML Identity Provider implementation discards the return value of its `validateSignature()` met

历史摘要 · 未重新核验 · GitHub Advisory

Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send

CVE-2026-41663

## Summary Several administrative operations in Admidio's preferences module (database backup, test email, htaccess gen

历史摘要 · 未重新核验 · GitHub Advisory

Admidio Missing Minimum Administrator Check in Role Membership Removal

CVE-2026-41662

## Summary `Role::stopMembership()` does not verify whether removing a user from the administrator role leaves zero adm

历史摘要 · 未重新核验 · GitHub Advisory

Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion

CVE-2026-41661

## Summary An unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's browser through a reflect

历史摘要 · 未重新核验 · GitHub Advisory

Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP

CVE-2026-41660

## Summary A logic error in Admidio's two-factor authentication reset inverts the authorization check. Non-admin users

历史摘要 · 未重新核验 · GitHub Advisory

Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment

CVE-2026-41659

## Summary The member assignment DataTables endpoint (`members_assignment_data.php`) includes hidden profile fields (BI

历史摘要 · 未重新核验 · GitHub Advisory

Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items

CVE-2026-41658

## Summary The Admidio inventory module enforces authorization for destructive operations (delete, retire, reinstate) o

历史摘要 · 未重新核验 · GitHub Advisory

Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php

CVE-2026-41657

## Summary The `contacts_data.php` endpoint uses a weaker permission check (`isAdministratorUsers()`, requiring only `r

历史摘要 · 未重新核验 · GitHub Advisory

Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read

CVE-2026-41656

## Summary The `add` mode in `modules/documents-files.php` accepts a `name` parameter validated only as `'string'` type

历史摘要 · 未重新核验 · GitHub Advisory

Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials

CVE-2026-41655

## Summary The `ecard_preview.php` endpoint does not validate that the `ecard_template` POST parameter is a safe filena

历史摘要 · 未重新核验 · GitHub Advisory

PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer

CVE-2026-40296

It was discovered that there is a way to bypass HTML escaping in the HTML writer using custom number format codes. ## T

历史摘要 · 未重新核验 · GitHub Advisory

PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer

CVE-2026-35453

### Summary The HTML Writer in PhpSpreadsheet bypasses `htmlspecialchars()` output escaping when a cell uses a custom nu

历史摘要 · 未重新核验 · GitHub Advisory

FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field

CVE-2026-32699

### Summary The application fails to validate the ```nick``` parameter during a ```POST``` request to the ```EditUser```

历史摘要 · 未重新核验 · GitHub Advisory