Most recent entries from all

EUVD-2026-267760

fkie_cve-2026-25892

Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.

GHSA-q4f2-39gr-45jh — Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Affected: Packagist: vrana/adminer

### Summary Adminer v5.4.1 has a version check mechanism where `adminer.org` sends signed version info via JavaScript postMessage, which the browser then POSTs to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, `openssl_verify()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users.

### Fix

Upgrade to Adminer 5.4.2.

**Mitigation** (if you can't upgrade): Make file `adminer.version` in temp directory (usually the value of [upload_tmp_dir](https://www.php.net/ini.core#ini.upload-tmp-dir)) unwritable by web server.

### Details

**1. Intended design of `?script=version`:**

The endpoint is designed to receive version data from `adminer.org` via browser JavaScript: - `functions.js` line 102-117: Creates iframe to `https://www.adminer.org/version/` - Adminer.org sends signed version data via `postMessage` - JavaScript POSTs this to `?script=version` - Server stores in `/tmp/adminer.version` for signature verification

```javascript // functions.js line 117 ajax(url + 'script=version', () => { }, event.data + '&token=' + token); ```

**2. The vulnerability:**

The endpoint only checks `$_GET["script"] == "version"` - it does not validate: - Request origin (no CSRF token check for this endpoint) - Request source (any HTTP client can POST) - Parameter types (`version` expected as string, array not re…

UBUNTU-CVE-2026-25892

Affected: Ubuntu:Pro:16.04:LTS: adminer, Ubuntu:Pro:18.04:LTS: adminer, Ubuntu:Pro:20.04:LTS: adminer, Ubuntu:22.04:LTS: adminer, Ubuntu:24.04:LTS: adminer, Ubuntu:25.10: adminer, Ubuntu:26.04:LTS: adminer