adminer vulnerabilities

9 known vulnerabilities in adminer from Vrana. 9 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  adminer: Improper Control of Generation of Code

  CVE-2026-109347Oct 12, 2026Vrana

  Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served

• 8.6 High severity

  adminer: Server-Side Request Forgery

  CVE-2026-100697Sep 26, 2026Vrana

  Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickho

• 9.8 Critical severity

  adminer: External Control of File Name or Path

  CVE-2026-56705Aug 25, 2026Vrana

  Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root,

• 7.2 High severity

  adminer: Improper Control of Generation of Code

  CVE-2026-56703Aug 25, 2026VranaEPSS 1.17%

  Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute com

• 8.8 High severity

  adminer: Unrestricted Upload of File with Dangerous Type

  CVE-2026-56702Aug 25, 2026Vrana

  Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to co

• 8.1 High severity

  adminer: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-34968Aug 25, 2026Vrana

  Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] paramete

• 7.1 High severity

  adminer: Improper Neutralization of CRLF Sequences in HTTP Headers

  CVE-2026-63771Jul 20, 2026Vrana

  Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit

• 7.5 High severity

  Adminer is open-source database management software.

  CVE-2026-25892Feb 9, 2026VranaEPSS 1.69%

  Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin va

• 7.2 High severity

  Adminer Server-Side Request Forgery Exploited

  CVE-2021-21311Feb 11, 2021VranaEPSS 98.5%

  Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is f