Product by Vrana

    Adminer

    19 known vulnerabilities in Adminer (Vrana), 1 of them actively exploited (CISA KEV).

    Key figures

    19

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Adminer (Vrana)
    CriticalCVE-2021-21311

    SSRF in adminer

    In CISA KEValso in 2 other products

    		7.2
    HighCVE-2021-29625

    XSS in doc_link

    also in 1 other product

    		7.5
    HighCVE-2026-56703

    Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO

    		7.2
    CriticalCVE-2026-56705

    Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

    		9.8
    HighCVE-2026-109347

    Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass

    		7.2
    HighCVE-2026-25892

    Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

    also in 1 other product

    		7.5
    HighCVE-2026-56702

    Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

    		8.8
    HighCVE-2026-100697

    Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver

    		8.6
    HighCVE-2026-34968

    Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop

    		8.1
    MediumCVE-2026-100696

    Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver

    		5.8
    MediumCVE-2026-100698

    Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex

    		5.8
    MediumCVE-2026-34964

    Adminer before 5.5.0 SSRF via PDO DSN Injection

    		5.8
    MediumCVE-2026-56706

    Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Masking

    		6.8
    HighCVE-2026-63771

    Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header

    		7.1
    MediumCVE-2026-100695

    Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE

    		6.1
    MediumCVE-2026-56704

    Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

    		6.1
    MediumCVE-2026-34967

    Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write

    		5.4
    MediumCVE-2026-34959

    Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix

    		4.7
    LowCVE-2026-16434

    Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass

    		—

    All products by Vrana