Adminer
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Adminer.
Known Exploited Adminer Vulnerabilities
The following Adminer vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Adminer Server-Side Request Forgery Vulnerability |
Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information. CVE-2021-21311 Exploit Probability: 94.2% |
September 29, 2025 |
The vulnerability CVE-2021-21311: Adminer Server-Side Request Forgery Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.
By the Year
In 2026 there have been 1 vulnerability in Adminer with an average score of 7.5 out of ten. Adminer did not have any published security vulnerabilities last year. That is, 1 more vulnerability have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1 | 7.50 |
| 2025 | 0 | 0.00 |
| 2024 | 2 | 9.80 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 7.50 |
| 2021 | 3 | 6.47 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 1 | 0.00 |
It may take a day or so for new Adminer vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Adminer Security Vulnerabilities
Adminer <5.4.2: PHP openssl_verify TypeError via version[]
CVE-2026-25892
7.5 - High
- February 09, 2026
Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.
Improper Input Validation
Adminer/ AdminerEvo SSRF via db connection fields (fixed in AdminerEvo 4.8.4)
CVE-2023-45195
- June 24, 2024
Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.
Adminer File Upload Path Traversal Allowing Root Exec (Fixed in 4.8.3)
CVE-2023-45197
9.8 - Critical
- June 21, 2024
The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of .. to the root of the Adminer directory. The attacker can effectively guess the name of the uploaded file and execute it. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.3.
Unrestricted File Upload
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3)
CVE-2021-43008
7.5 - High
- April 05, 2022
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
Adminer is open-source database management software
CVE-2021-29625
6.1 - Medium
- May 19, 2021
Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).
XSS
Adminer is an open-source database management in a single PHP file
CVE-2021-21311
7.2 - High
- February 11, 2021
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
SSRF
Adminer through 4.7.8
CVE-2020-35572
6.1 - Medium
- February 09, 2021
Adminer through 4.7.8 allows XSS via the history parameter to the default URI.
XSS
Adminer through 4.3.1 has SSRF
CVE-2018-7667
- March 05, 2018
Adminer through 4.3.1 has SSRF via the server parameter.
