Threat Intelligence Database

Adminer versions before 5.4.3 contain a vulnerability where the server field is not properly sanitized before constructing a PDO DSN string. This allows unauthenticated attackers to inject ODBC parameters via semicolons, including TraceFile and TraceOn, which can write PHP code to the web root. Accessing the trace file leads to remote code execution.

CVE-2026-56704 is a cross-site scripting (XSS) vulnerability in Adminer before version 5.4.3. The issue arises because Adminer inserts unsanitized database server version strings into script tags that use valid Content Security Policy (CSP) nonces without proper validation. This allows an attacker controlling a malicious MySQL server to craft version strings that break out of the JavaScript context and execute arbitrary code, effectively bypassing CSP protections.

Adminer versions before 5.4.3 have a remote code execution vulnerability due to improper control of SQLite query handling. Authenticated attackers can exploit the VACUUM INTO command to write PHP code to arbitrary file paths and execute commands on the server.

Adminer versions before 5.4.3 have a vulnerability in SQLite mode where the database-list drop action does not properly validate file extensions before deleting files. This allows an authenticated attacker to provide arbitrary relative file paths via the db[] parameter to delete any files writable by the PHP process.

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled have an arbitrary file write vulnerability. An authenticated user can exploit a path traversal issue in the ns parameter of plugins/sql-log.php to write attacker-controlled .sql files to any writable directory on the host.

Adminer versions before 5.5.0 have a server-side request forgery (SSRF) vulnerability in the login form's server field validator. The validator only checks leading integers for privileged ports and does not reject non-numeric port values. This allows attackers to inject PDO DSN keys such as host= and port= into the server parameter, bypassing privileged-port restrictions and enabling TCP connections to arbitrary internal hosts and ports before authentication.

Adminer versions 4.6.0 before 5.5.0 improperly validate the client-supplied X-Forwarded-Prefix header, allowing it to be prepended to the REQUEST_URI without trusted-proxy checks or validation. This flaw enables an authenticated attacker to cause open redirects after POST requests, control the session cookie path attribute without authentication, and poison self-referential links. However, injection of CR/LF characters is not possible, preventing header splitting or XSS attacks.

Adminer versions 4.6.0 through 5.5.0 contain an incomplete fix for a prior X-Forwarded-Prefix header validation vulnerability. The validation only blocks prefixes starting with double forward slashes but allows prefixes with a backslash as the second character, which browsers normalize to a forward slash. This can cause anomalous cookie-path scoping via the Set-Cookie Path attribute. Exploitation requires the ability to set the X-Forwarded-Prefix header, typically due to a misconfigured or absent reverse proxy. The issue was fixed in version 5.5.1.