EUVD-2026-63460
GHSA-cmr6-cvgm-wxx6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable endpoint requires high privileges (valid database credentials) to trigger; no user interaction; full web server process compromise but no scope change.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability.
The specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201.
AnalysisAI
Remote code execution in Adminer 5.4.2 allows authenticated high-privilege users to execute arbitrary code in the context of the web server by exploiting an incorrect function return value check in the multi_query method (CWE-253). The CVSS base score of 7.2 (High) reflects full confidentiality, integrity, and availability impact once authentication is satisfied. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Authentication with high-privilege credentials is required to exploit this vulnerability, confirmed both by the CVE description ('Authentication is required to exploit this vulnerability') and the CVSS PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H places real-world risk in a well-defined envelope: network-reachable but gated entirely behind high-privilege authentication, with no attack complexity once credentials are held. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Adminer GitHub security advisory (https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7) for the confirmed patched release version and apply it immediately - a specific fix version number was not extractable from the available intelligence and must be verified directly from the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Adminer 5.4.2, audit which users hold administrative access, and immediately restrict administrative privileges to a minimal trusted group. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Adminer through 4.3.1 has SSRF via the server parameter. Rated critical severity (CVSS 9.8), this vulnerability is remot
Adminer versions 5.4.1 and earlier suffer from a post-message validation bypass that allows remote attackers to trigger
Adminer is an open-source database management in a single PHP file. Rated high severity (CVSS 7.2), this vulnerability i
Adminer is open-source database management software. Rated medium severity (CVSS 6.1), this vulnerability is remotely ex
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. Rated critical severit
Remote code execution in Adminer before 5.4.3 (the single-file PHP database management tool) allows unauthenticated atta
Remote code execution in Adminer before 5.4.3 allows authenticated attackers connected to a SQLite database to write arb
Arbitrary file deletion in Adminer before 5.4.3 exposes any file writable by the PHP process to authenticated attackers
Unrestricted PHP file upload in Adminer's AdminerFileUpload plugin (versions before 5.4.3) allows any authenticated low-
Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal
Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single val
Cross-site scripting with CSP bypass in Adminer before 5.4.3 enables arbitrary JavaScript execution in the browser of an
Same weakness CWE-253 – Incorrect Check of Function Return Value
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today