Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: vrana adminer 6.0.2 Clear all filters
TI-2026-64854 CVE-2026-100698 · GHSA-wrf7-8p9h-xp6p

Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex

Priority HIGH 70

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00347 Published 2026-09-26 Fixed in 6.0.2 CWE-918
TI-2026-64853 CVE-2026-100697 · GHSA-9w28-5vwj-mq45

Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver

Priority MEDIUM 63

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.004 Published 2026-09-26 Fixed in 6.0.2 CWE-918
TI-2026-64852 CVE-2026-100696 · GHSA-c9jj-9w3r-2hj8

Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver

Priority HIGH 70

Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00387 Published 2026-09-26 Fixed in 6.0.2 CWE-918
TI-2026-64851 CVE-2026-100695 · GHSA-3hv2-gxcf-jxpg

Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE

Priority MEDIUM 57

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitr…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00338 Published 2026-09-26 Fixed in 6.0.2 CWE-79