CVE-2021-43810

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Admidio	admidio	< 4.0.12

References

https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21Patch, Third Party Advisory
https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404bPatch, Third Party Advisory
https://github.com/Admidio/admidio/releases/tag/v4.0.12Patch, Release Notes, Third Party Advisory
https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hhThird Party Advisory
https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21Patch, Third Party Advisory
https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404bPatch, Third Party Advisory
https://github.com/Admidio/admidio/releases/tag/v4.0.12Patch, Release Notes, Third Party Advisory
https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hhThird Party Advisory

Timeline

Published: Dec 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-438117.8Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model a CVE-2021-438126.1The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out cer CVE-2021-438134.3Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory travers CVE-2021-438147.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out CVE-2021-438154.3Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal fo CVE-2021-438169.1containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with co CVE-2021-438176.1Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability CVE-2021-438187.1lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain cra CVE-2021-438195.3Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment. In affected versions Minecarts with chests wi CVE-2021-43828.8The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() CVE-2021-438205.9Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. T CVE-2021-438217.7Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local