Vrana Adminer
13 CVEs affecting Vrana Adminer. Latest disclosed: 2026-08-25. Critical: 1, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56705 | Critical | 9.8 | 2026-08-25 | Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via… |
CVE-2026-56702 | High | 8.8 | 2026-08-25 | Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP f… |
CVE-2026-34968 | High | 8.1 | 2026-08-25 | Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions bef… |
CVE-2026-25892 | High | 7.5 | 2026-02-09 | Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via J… |
CVE-2021-29625 | High | 7.5 | 2021-05-19 | Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, P… |
CVE-2026-56703 | High | 7.2 | 2026-08-25 | Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Auth… |
CVE-2021-21311 | High | 7.2 | 2021-02-11 | Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulne… |
CVE-2026-63771 | High | 7.1 | 2026-07-20 | Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the… |
CVE-2026-56706 | Medium | 6.8 | 2026-08-25 | Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing an… |
CVE-2026-56704 | Medium | 6.1 | 2026-08-25 | Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controllin… |
CVE-2026-34964 | Medium | 5.8 | 2026-08-25 | Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for… |
CVE-2026-34959 | Medium | 4.7 | 2026-08-25 | Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of t… |
CVE-2026-16434 | | 2026-08-25 | Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guar… |