Summary
It was discovered that Adminer did not escape data in the history parameter
of the default URI. A remote attacker could possibly use this issue to perform
cross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 ESM.
(CVE-2020-35572)
Adam Crosser and Brian Sizemore discovered that Adminer incorrectly handled
redirection requests to internal servers. An unauthenticated remote attacker
could possibly use this to perform a server-side request forgery attack and
expose sensitive information. (CVE-2021-21311)
It was discovered that Adminer was incorrectly escaping data in the doc_link
function. A remote attacker could possibly use this issue to perform cross-site
scripting (XSS) attacks. This issue only affected Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2021-29625)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | adminer | 4.2.1-1ubuntu1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | adminer | 4.6.2-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | adminer | 4.7.6-1ubuntu0.1~esm1 |
Vulnerabilities 3
-
High 7.2
SSRF in adminer
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is …
KEV Sep 29, 2025 -
High 7.5CVE-2021-29625 Scanner template
XSS in doc_link
Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only excep…
-
Medium 6.1
vrana/adminer via XSS in the history parameter in SQL command
Adminer through 4.7.8 allows XSS via the history parameter to the default URI.