Threat Intelligence Database

Adminer versions before 6.1.1 have a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by using a UTF-8 byte-order mark prefix. This enables attackers to attach a database file at a PHP-served path and create a table named with PHP code, which can then be executed as the web server user.

Adminer versions from 5.5.1 through 6.0.1 contain a server-side request forgery (SSRF) vulnerability due to improper parsing of the login 'server' string. This allows a remote unauthenticated attacker to craft a server value that bypasses privileged-port restrictions and causes the server to initiate TCP connections to arbitrary internal hosts and ports before authentication. This vulnerability enables blind internal port scanning and was fixed in version 6.0.2.

Adminer versions 6.0.0 and 6.0.1 are vulnerable to a pre-authentication Server-Side Request Forgery (SSRF) when the official ClickHouse driver plugin is loaded. An unauthenticated attacker can cause the server to send arbitrary HTTP POST requests to internal or external URLs, potentially disclosing sensitive internal information via error responses. This vulnerability is fixed in Adminer 6.0.2.

Adminer versions from 0 up to but not including 6.0.2 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver. This flaw allows an unauthenticated attacker to cause the server to make HTTP GET requests to arbitrary internal or external hosts by submitting crafted authentication parameters. The vulnerability enables internal network reconnaissance and service fingerprinting via error messages displayed on the login page. Exploitation requires the Elasticsearch driver to be explicitly enabled and PHP's allow_url_fopen setting to be active. The issue is fixed in Adminer version 6.0.2.

Adminer versions before 6.0.2 have a cross-site scripting (XSS) vulnerability caused by improper escaping of the CONNECTION_ID() database result in JavaScript. This flaw allows a malicious database server to execute arbitrary JavaScript in the context of the authenticated Adminer user. In deployments where the database has FILE privileges and can write to the webroot, attackers can leverage this XSS to submit authenticated SQL commands that write PHP files, potentially leading to remote code execution under the web server's account.

Adminer versions before 5.4.3 contain a vulnerability where the server field is not properly sanitized before constructing a PDO DSN string. This allows unauthenticated attackers to inject ODBC parameters via semicolons, including TraceFile and TraceOn, which can be used to write PHP code to the web root and achieve remote code execution.

CVE-2026-56704 is a cross-site scripting (XSS) vulnerability in Adminer before version 5.4.3. The issue arises because unsanitized database server version strings are inserted into script tags with valid Content Security Policy (CSP) nonces without proper validation. This allows an attacker controlling a rogue MySQL server to craft malicious version strings that break out of the JavaScript context and execute arbitrary code, bypassing CSP protections.

Adminer versions prior to 5.4.3 contain a remote code execution vulnerability related to improper handling of SQLite VACUUM INTO commands. Authenticated attackers can exploit this flaw to write and execute arbitrary PHP code on the server by bypassing ATTACH restrictions. This vulnerability has a high severity rating and a CVSS score of 8.6.

Adminer versions prior to 5.4.3 contain a path traversal vulnerability in SQLite mode that allows authenticated users to delete arbitrary files writable by the PHP process. This occurs because the database-list drop action does not properly validate file extensions before deletion, enabling attackers to submit crafted relative file paths via the db[] parameter.

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.