admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.
CVE Status: Modified
No CVSS data available
Exploit-db Github