CVE-2025-62617
High
Description
Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 4.3.17.
SeverityHigh
CVSS7.2
Exploit probability—
ProductAdmidio
PublishedOct 22, 2025
First seenOct 22, 2025
Weakness typeCWE-89SQL injection
How to fix
Update
- admidio admidio4.3.17 or later
- admidio/admidio4.3.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| admidio admidio | v < 4.3.17 | 4.3.17 |
| admidio/admidioPackagist | v < 4.3.17 | 4.3.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.