CVE-2026-100698 | Medium | 5.8 | 2026-09-26 | Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture grou… |
CVE-2026-100697 | High | 8.6 | 2026-09-26 | Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-au… |
CVE-2026-100696 | Medium | 5.8 | 2026-09-26 | Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/driver… |
CVE-2026-100695 | Medium | 6.1 | 2026-09-26 | Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper esc… |
CVE-2026-56706 | Medium | 6.8 | 2026-08-25 | Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing an… |
CVE-2026-56705 | Critical | 9.8 | 2026-08-25 | Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via… |
CVE-2026-56704 | Medium | 6.1 | 2026-08-25 | Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controllin… |
CVE-2026-56703 | High | 7.2 | 2026-08-25 | Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Auth… |
CVE-2026-56702 | High | 8.8 | 2026-08-25 | Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP f… |
CVE-2026-34968 | High | 8.1 | 2026-08-25 | Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions bef… |
CVE-2026-34967 | Medium | 5.4 | 2026-08-25 | Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php… |
CVE-2026-34964 | Medium | 5.8 | 2026-08-25 | Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for… |
CVE-2026-34959 | Medium | 4.7 | 2026-08-25 | Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of t… |
CVE-2026-16434 | | | 2026-08-25 | Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guar… |
CVE-2026-63771 | High | 7.1 | 2026-07-20 | Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the… |
CVE-2026-25892 | High | 7.5 | 2026-02-09 | Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via J… |
CVE-2021-29625 | High | 7.5 | 2021-05-19 | Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, P… |
CVE-2021-21311 | High | 7.2 | 2021-02-11 | Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulne… |