Adminer-CVE-2021-43008

Adminer CVE-2021-43008 PoC Preuve de concept pour CVE-2021-43008 affectant Adminer. Cette vulnérabilité permet à un serveur MySQL malveillant de demander des fichiers locaux arbitraires depuis la machine cliente lorsque LOAD DATA LOCAL INFILE est activé. Le dépôt contient des outils pour reprodui...

CVE-2025-43960

CVE-2025-43960 - Adminer 4.8.1 में Monolog के माध्यम से PHP Object Injection - Denial of Service DoS MITRE से प्रतिक्रिया की प्रतीक्षा करने के महीनों के बाद, मैंने Adminer सेवा 4.8.1 के विरुद्ध PHP Object Injection हमले के साथ CVE-2025-43960 प्राप्त किया, जो मेमोरी मैनिपुलेशन के माध्यम से Denial ...

CVE-2021-21311

CVE-2021-21311 Descrição SSRF Server-side Request Forgery no Adminer ferramenta de gerenciamento de banco de dados de código aberto das versões v4.0.0 v4.7.8 corrigido na v4.7.9 Commit do patch Uso root@kitploit: exploit.py -h -target TARGET -redirect REDIRECT -host HOST -port PORT options: -h,...

Adminer <=4.8.0 - Cross-Site Scripting

Adminer 4.6.1 to 4.8.0 contains a cross-site scripting vulnerability which affects users of MySQL, MariaDB, PgSQL, and SQLite in browsers without CSP when Adminer uses a pdo extension to communicate with the database it is used if the native extensions are not enabled. id: CVE-2021-29625 info:...

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. id: CVE-2026-25892 info: name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent Do...

CVE-2021-43008-AdminerRead

CVE-2021-43008 - AdminerRead Exploit-Tool für die Arbitrary-File-Read-Schwachstelle in Adminer 1.0 bis 4.6.2 Installation root@kitploit: git clone https://github.com/p0dalirius/AdminerRead cd AdminerRead sudo python3 setup.py install Verwendung...

sudowp-adminer

SudoWP Adminer Sicherheits-Fork Mitwirkende: SudoWP, WP Republic Ursprüngliche Autoren: Frank Bültge, Inpsyde Tags: adminer, database, security, cve-2021-21311, ssrf-patch Erfordert mindestens: 5.8 Getestet bis: 6.7 Stabile Version: 1.5.0 Lizenz: GPLv2 oder später Sicherheitshinweis CVE-2021-2131...

Adminer <4.7.9 - Server-Side Request Forgery

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized...

DEBIAN-CVE-2026-56705

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

DEBIAN-CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56703

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...

DEBIAN-CVE-2026-56703

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...

DEBIAN-CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

CVE-2026-56705

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

DEBIAN-CVE-2026-56702

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute...

DEBIAN-CVE-2026-34967

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled conte...

CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...