EUVD-2026-65197
GHSA-5v92-397q-w6q6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable pre-auth SSRF with no complexity or interaction; scope changes because internal subsequent systems are reachable, but impact limited to low confidentiality via network probing.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication.
AnalysisAI
Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal hosts and ports by injecting PDO DSN keys into the login form's server parameter. The root cause is an incomplete port-validation routine that only inspects leading numeric characters, failing to reject non-numeric port values; a crafted server string such as 'host=internal.host port=6379' bypasses the privileged-port restriction entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Adminer must be network-accessible to the attacker, which includes any internet-facing deployment or internal network segment the attacker can reach. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.9 is driven by AV:N/AC:L/AT:N/PR:N/UI:N, reflecting trivial unauthenticated remote exploitation with no special attack requirements; the limited impact metrics (VC:L, SC:L, all others N) correctly capture an SSRF primitive whose direct damage is network enumeration rather than full compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Adminer to version 5.5.0 or later, which addresses the incomplete port-validation logic in the server-field sanitizer; the vendor advisory at https://github.com/vrana/adminer/security/advisories/GHSA-58cq-mgw2-38m5 and the VulnCheck advisory at https://www.vulncheck.com/advisories/adminer-before-ssrf-via-pdo-dsn-injection both reference this fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Adminer through 4.3.1 has SSRF via the server parameter. Rated critical severity (CVSS 9.8), this vulnerability is remot
Adminer versions 5.4.1 and earlier suffer from a post-message validation bypass that allows remote attackers to trigger
Adminer is an open-source database management in a single PHP file. Rated high severity (CVSS 7.2), this vulnerability i
Adminer is open-source database management software. Rated medium severity (CVSS 6.1), this vulnerability is remotely ex
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. Rated critical severit
Remote code execution in Adminer before 5.4.3 (the single-file PHP database management tool) allows unauthenticated atta
Remote code execution in Adminer before 5.4.3 allows authenticated attackers connected to a SQLite database to write arb
Remote code execution in Adminer 5.4.2 allows authenticated high-privilege users to execute arbitrary code in the contex
Arbitrary file deletion in Adminer before 5.4.3 exposes any file writable by the PHP process to authenticated attackers
Unrestricted PHP file upload in Adminer's AdminerFileUpload plugin (versions before 5.4.3) allows any authenticated low-
Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single val
Cross-site scripting with CSP bypass in Adminer before 5.4.3 enables arbitrary JavaScript execution in the browser of an
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today