Threats tagged 'ghsa-3hv2-gxcf-jxpg'

Adminer versions before 6.0.2 have a cross-site scripting (XSS) vulnerability caused by improper escaping of the CONNECTION_ID() database result in JavaScript. This flaw allows a malicious database server to execute arbitrary JavaScript in the context of the authenticated Adminer user. In deployments where the database has FILE privileges and can write to the webroot, attackers can leverage this XSS to submit authenticated SQL commands that write PHP files, potentially leading to remote code execution under the web server's account.