EUVD-2026-65202
GHSA-gx46-wch5-wp5p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS requires victim to initiate connection to rogue server (UI:R); nonce inheritance causes scope change affecting victim browser (S:C); no confidentiality or integrity impact on availability.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.
AnalysisAI
Cross-site scripting with CSP bypass in Adminer before 5.4.3 enables arbitrary JavaScript execution in the browser of any user who connects to an attacker-controlled MySQL server. The vulnerability stems from unsanitized MySQL server version strings being injected directly into script tags that carry valid Content Security Policy nonces, effectively nullifying CSP protections. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must control or compromise a MySQL server that the victim will connect to via Adminer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) reflects the required user interaction (UI:P) - the victim must actively connect Adminer to an attacker-controlled MySQL server - which substantially limits opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Adminer 5.4.3 or later, which introduces proper sanitization of the MySQL server version string before it is inserted into script contexts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Adminer through 4.3.1 has SSRF via the server parameter. Rated critical severity (CVSS 9.8), this vulnerability is remot
Adminer versions 5.4.1 and earlier suffer from a post-message validation bypass that allows remote attackers to trigger
Adminer is an open-source database management in a single PHP file. Rated high severity (CVSS 7.2), this vulnerability i
Adminer is open-source database management software. Rated medium severity (CVSS 6.1), this vulnerability is remotely ex
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. Rated critical severit
Remote code execution in Adminer before 5.4.3 (the single-file PHP database management tool) allows unauthenticated atta
Remote code execution in Adminer before 5.4.3 allows authenticated attackers connected to a SQLite database to write arb
Remote code execution in Adminer 5.4.2 allows authenticated high-privilege users to execute arbitrary code in the contex
Arbitrary file deletion in Adminer before 5.4.3 exposes any file writable by the PHP process to authenticated attackers
Unrestricted PHP file upload in Adminer's AdminerFileUpload plugin (versions before 5.4.3) allows any authenticated low-
Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal
Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single val
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today