GCVE - cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Adminer (`831b3fc3-7a9d-56cb-8b1d-ad0e3d9c479a`)
Product	Adminer (`40ae6147-a315-59f7-81f1-2a9262459466`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/adminer`	purl2cpe	2026-06-01 10:16:30.201660
`pkg:deb/ubuntu/adminer`	purl2cpe	2026-06-01 10:16:30.201662
`pkg:docker/adminer`	purl2cpe	2026-06-01 10:16:30.201663
`pkg:github/vrana/adminer`	purl2cpe	2026-06-01 10:16:30.201665
`pkg:rpm/opensuse/adminer`	purl2cpe	2026-06-01 10:16:30.201666
`pkg:sourceforge/adminer`	purl2cpe	2026-06-01 10:16:30.201668

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-25892`	vulnerable	2026-06-08 07:53:20.586406	Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint HIGH (7.5) Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2. Published: 2026-02-09T21:26:45.224Z Updated: 2026-02-10T15:57:46.865Z Open on db.gcve.eu Reference links https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3 https://github.com/vrana/adminer/releases/tag/v5.4.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-45197`	vulnerable	2026-06-08 06:12:42.178897	Adminer and AdminerEvo vulnerable to directory traversal and file upload The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attacker can effectively guess the name of the uploaded file and execute it. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.3. Published: 2024-06-21T14:28:36.476Z Updated: 2024-08-02T20:14:19.841Z Open on db.gcve.eu Reference links https://github.com/adminerevo/adminerevo/commit/1cc06d6a1005fd833fa009701badd5641627a1d4 https://github.com/adminerevo/adminerevo/releases/tag/v4.8.3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-45196`	vulnerable	2026-06-08 06:12:42.178149	Adminer and AdminerEvo denial of service via HTTP redirect Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4. Published: 2024-06-24T20:48:21.534Z Updated: 2024-08-02T20:14:20.034Z Open on db.gcve.eu Reference links https://github.com/adminerevo/adminerevo/pull/102/commits/23e7cdc0a32b3739e13d19ae504be0fe215142b6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-45195`	vulnerable	2026-06-08 06:12:42.175040	Adminer and AdminerEvo SSRF Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4. Published: 2024-06-24T21:06:09.735Z Updated: 2024-08-02T20:14:19.950Z Open on db.gcve.eu Reference links https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-43008`	vulnerable	2026-06-08 05:35:23.086892	Details available Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database. Published: 2022-04-05T01:46:09.000Z Updated: 2024-08-04T03:47:13.222Z Open on db.gcve.eu Reference links https://github.com/vrana/adminer/releases/tag/v4.6.3 https://www.adminer.org/ https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability https://podalirius.net/en/cves/2021-43008/ https://lists.debian.org/debian-lts-announce/2022/05/msg00012.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-29625`	vulnerable	2026-06-08 05:31:26.601510	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21311`	vulnerable	2026-06-08 05:29:11.596573	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-35572`	vulnerable	2026-06-08 05:25:01.346423	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-7667`	vulnerable	2026-06-08 05:12:03.959924	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.