CVE-2026-56704

MEDIUM 6.1

Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.

CWE	CWE-79
Vendor	vrana
Product	adminer
Published	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for vrana adminer

Be the first to know when new medium vulnerabilities affecting vrana adminer are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

vrana / adminer

0 < 5.4.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj vulncheck.com: https://www.vulncheck.com/advisories/adminer-before-cross-site-scripting-via-mysql-version-string

Credits

🔍 AmirMSafari