https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 00:22:03 +0000 https://cve.radiocsirt.org/vuln/bdu:2021-03209 bdu:2021-03209 https://cve.radiocsirt.org/vuln/bdu:2021-03209 https://cve.radiocsirt.org/vuln/euvd-2026-27983 EUVD-2026-27983 https://cve.radiocsirt.org/vuln/euvd-2026-27983 https://cve.radiocsirt.org/vuln/fkie_cve-2021-32630 <p>Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents &amp; Files upload feature. Someone with upload permissions could rename the php shell with a .phar extension, visit the file, triggering the payload for a reverse/bind shell. This can be mitigated by excluding a .phar file extension to be uploaded (like you did with .php .phtml .php5 etc). The vulnerability is patched in version 4.0.4.</p> <p>Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents &amp; Files upload feature. Someone with upload permissions could rename the php shell with a .phar extension, visit the file, triggering the payload for a reverse/bind shell. This can be mitigated by excluding a .phar file extension to be uploaded (like you did with .php .phtml .php5 etc). The vulnerability is patched in version 4.0.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-32630 https://cve.radiocsirt.org/vuln/gsd-2021-32630 gsd-2021-32630 https://cve.radiocsirt.org/vuln/gsd-2021-32630