adminer
v6.3.0Database management in a single PHP file
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- OtherUnknown
- Security
- 22 advisories1 critical, 6 high, 13 medium, 2 low · Scorecard 3.9/10
- Supported versions
- No scheduleendoflife.date does not track this project
8k stars · 1.2k forks · 2 open issues · last release 11 days ago · data checked 48 minutes ago
Security advisories
All advisories on GitHubThe 22 most recent advisories published by the maintainers: 1 critical, 6 high, 13 medium, 2 low. Check the patched version against the one you run.
- highGHSA-r9r5-j5q8-8c59Sep 25, 2026Adminer RCE via UTF-8 BOM Bypass of SQLite ATTACH/VACUUM INTO Restrictions
- Affected
- <= 6.1.0
- Patched in
- 6.1.1
- mediumGHSA-q8h3-4cx4-prgmSep 7, 2026Unauthenticated Pre-Authentication SSRF in Adminer Elasticsearch Plugin
- Affected
- 4.16.0 - 6.0.1
- Patched in
- 6.0.2
- mediumGHSA-7c5h-q78c-fpxxSep 7, 2026Conditional RCE via CONNECTION_ID XSS + INTO DUMPFILE
- Affected
- <= 6.0.1
- Patched in
- 6.0.2
- mediumGHSA-rwxg-xph9-82cjSep 7, 2026Privileged-port SSRF via host_port regex non-match
- Affected
- 5.5.1 - 6.0.1
- Patched in
- 6.0.2
- mediumGHSA-77qq-q8fv-x45vSep 7, 2026Adminer 6.0.0: ClickHouse driver reflects arbitrary HTTP response body on login error (pre-auth SSRF with full response echo)
- Affected
- <= 6.0.1
- Patched in
- 6.0.2
- lowGHSA-fr74-9mf9-gf44Jul 21, 2026X-Forwarded-Prefix backslash bypass
- Affected
- 4.6.0 - 5.5.0
- Patched in
- 5.5.1
- mediumGHSA-8478-xrj3-h9c2Jul 17, 2026X-Forwarded-Prefix open redirect
- Affected
- 4.6.0 - 5.4.4
- Patched in
- 5.5.0
- mediumGHSA-58cq-mgw2-38m5Jul 17, 2026Pre-auth SSRF via PDO DSN injection in server field (privileged-port validator bypass) — 5.4.5-dev
- Affected
- <= 5.4.4
- Patched in
- 5.5.0
- mediumGHSA-75xm-qwfq-9wp5Jul 9, 2026Arbitrary .sql file write via unvalidated ns in sql-log plugin
- Affected
- >= 5.3.0, <= 5.4.2
- Patched in
- 5.4.3
- highGHSA-6pg3-chwq-wgqcJul 9, 2026Adminer SQLite Database-List Drop Arbitrary File Deletion
- Affected
- < 5.4.3
- Patched in
- 5.4.3
- highGHSA-gmx3-g29w-77wfJul 9, 2026RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
- Affected
- <=5.4.2
- Patched in
- 5.4.3
- lowGHSA-vcvj-rwwm-x6g5Jul 9, 2026AdminerFileUpload Allows PHP File Upload Leading to RCE
- Affected
- <= 5.4.2
- Patched in
- 5.4.3
- mediumGHSA-h6jr-7pr6-grgjJul 9, 2026XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
- Affected
- <=5.4.2
- Patched in
- 5.4.3
- criticalGHSA-r4x9-5m63-3vxwJul 9, 2026Unauthenticated RCE via MSSQL PDO DSN Injection
- Affected
- <=5.4.2
- Patched in
- 5.4.3
- mediumGHSA-c533-9qwm-8w5hJul 9, 2026Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
- Affected
- >= 4.6.0, <= 5.4.2
- Patched in
- 5.4.3
- mediumGHSA-33j4-hc95-pgggJul 9, 2026CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
- Affected
- <= 5.4.3-dev
- Patched in
- 5.4.3
- highGHSA-3582-q6xq-5vf7Jul 9, 2026ZDI-CAN-28201: multi_query Incorrect Check of Function Return Value RCE
- Affected
- 5.4.2
- Patched in
- 5.4.3
- highCVE-2026-25892Feb 8, 2026Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
- Affected
- 4.6.2 - 5.4.1
- Patched in
- 5.4.2
- mediumCVE-2021-29625May 15, 2021XSS in doc_link
- Affected
- 4.6.1 to 4.8.0
- Patched in
- 4.8.1
- mediumCVE-2021-21311Feb 10, 2021SSRF on error page of Elasticsearch and ClickHouse
- Affected
- 4.0.0 to 4.7.8
- Patched in
- 4.7.9
- mediumCVE-2018-7667Feb 10, 2021SSRF by connecting to privileged ports
- Affected
- < 4.7.8
- Patched in
- 4.7.8
- highCVE-2020-35572Feb 10, 2021XSS via the history parameter in SQL command
- Affected
- 4.7.0 to 4.7.8
- Patched in
- 4.7.9