Read the docs
TI-2021-04411 Aliases CVE-2021-21311GHSA-x5r2-hj5c-8jx6

SSRF in adminer

Priority CRITICAL 89Exploited in the wildCWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.

Why it matters now

Exploitation Active In CISA KEV since 2025-09-29CISA due date 2025-10-20
EPSS 0.98464 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed adminer (vrana): 4.7.9vrana/adminer (Packagist): 4.7.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Admineradminer4.0.0 to before 4.7.94.7.9Patch availableCNA
—vrana/adminer (Packagist)before 4.7.94.7.9Patch availableGHSA-x5r2-hj5c-8jx6
  • adminer VendorAdminer Affected 4.0.0 to before 4.7.9 Fixed in 4.7.9 Patch available CNA
  • vrana/adminer (Packagist) Vendor— Affected before 4.7.9 Fixed in 4.7.9 Patch available GHSA-x5r2-hj5c-8jx6

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*4.0.0 to before 4.7.9VulnerableAdminer
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.7.9 Vulnerable ·Adminer
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · CNA adminer (vrana) Fixed in 4.7.9
  • Fix · GHSA-x5r2-hj5c-8jx6 vrana/adminer (Packagist) Fixed in 4.7.9 Advisory →

Timeline

  1. 2025-09-29 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-21311
  3. 2026-10-03 Alias added: GHSA-x5r2-hj5c-8jx6

References

Exploit 1

Patch 2

Advisory 3

Other 3

  • TI-2018-05526 Adminer through 4.3.1 has SSRF via the server parameter. CVSS 3.0CRITICAL 9.8
  • TI-2021-19077 Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3)… CVSS 3.1HIGH 7.5
  • TI-2025-28520 Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory… CVSS 3.1HIGH 8.6
  • TI-2021-10333 XSS in doc_link CVSS 3.1HIGH 7.5
  • TI-2026-20931 Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint CVSS 3.1HIGH 7.5
  • TI-2020-18079 Adminer through 4.7.8 allows XSS via the history parameter to the default URI. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences