AIKIDO-2026-171237

vrana/adminer is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-7c5h-q78c-fpxx Published Yesterday

Medium Risk

This Affects:

vrana/adminer

4.0.0 - 6.0.1

Fixed in 6.0.2

Are you affected? Scan for Free

TL;DR

Adminer interpolates the CONNECTION_ID() value reported by a MySQL-compatible server straight into inline JavaScript when it renders the slow-query kill control, without checking that the value is numeric. A database server the user connects to can return script content in that position and have it execute in the authenticated Adminer origin. Code execution on the host follows only in the narrower case where the database also holds FILE privileges and shares a writable webroot with Adminer. The fix casts the connection id to a number before it is written into JavaScript.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and users can be induced to connect Adminer to an untrusted MySQL/MariaDB-compatible server.