Vrana vulnerabilities
We track 9 vulnerabilities in Vrana products. 9 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 12, 2026.
Latest Vrana vulnerabilities
- 7.2 High severity
adminer: Improper Control of Generation of Code
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served
- 8.6 High severity
adminer: Server-Side Request Forgery
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickho
- 9.8 Critical severity
adminer: External Control of File Name or Path
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root,
- 7.2 High severity
adminer: Improper Control of Generation of Code
Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute com
- 8.8 High severity
adminer: Unrestricted Upload of File with Dangerous Type
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to co
- 8.1 High severity
adminer: Improper Limitation of a Pathname to a Restricted Directory
Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] paramete
- 7.1 High severity
adminer: Improper Neutralization of CRLF Sequences in HTTP Headers
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit
- 7.5 High severity
Adminer is open-source database management software.
Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin va
- 7.2 High severity
Adminer Server-Side Request Forgery Exploited
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is f