{"schema_version":"2","view":"grouped","data":[{"id":28723,"cve_ids":["CVE-2026-109347"],"payload":{"kind":"advisory","title":"Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass","summary":"Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.","evidence":"cve:CVE-2026-109347","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109347","aliases":["CVE-2026-109347"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.1.1","versionType":"semver"},{"status":"unaffected","version":"6.1.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T02:50:48.679Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59","https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109347","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T02:50:22.310218Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T02:50:48.679Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T16:05:31.293Z"}}},"related_cves":[{"value":"CVE-2026-109347","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:765dcb84-fd8b-4192-985e-ae0ea2daf6af","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109347","advisory_id":"765dcb84-fd8b-4192-985e-ae0ea2daf6af","event_types":["advisory"],"published_at":"2026-10-25T07:43:26.936945+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T16:05:31.293+00:00","detail_url":"/advisories/advisory%3A765dcb84-fd8b-4192-985e-ae0ea2daf6af","group":{"id":"advisory:765dcb84-fd8b-4192-985e-ae0ea2daf6af","revision":1,"primary_event_id":28500,"change":"published","superseded_by":[],"changed":{"id":28500,"cve_ids":["CVE-2026-109347"],"payload":{"kind":"advisory","title":"Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass","summary":"Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.","evidence":"cve:CVE-2026-109347","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109347","aliases":["CVE-2026-109347"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.1.1","versionType":"semver"},{"status":"unaffected","version":"6.1.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T02:50:48.679Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59","https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109347","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T02:50:22.310218Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T02:50:48.679Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T16:05:31.293Z"}}},"related_cves":[{"value":"CVE-2026-109347","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:765dcb84-fd8b-4192-985e-ae0ea2daf6af","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109347","advisory_id":"765dcb84-fd8b-4192-985e-ae0ea2daf6af","event_types":["advisory"],"published_at":"2026-10-25T07:43:26.936945+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T16:05:31.293+00:00","detail_url":"/events/28500"},"members":[{"id":28500,"cve_ids":["CVE-2026-109347"],"payload":{"kind":"advisory","title":"Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass","summary":"Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.","evidence":"cve:CVE-2026-109347","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109347","aliases":["CVE-2026-109347"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.1.1","versionType":"semver"},{"status":"unaffected","version":"6.1.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T02:50:48.679Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59","https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109347","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T02:50:22.310218Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T02:50:48.679Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T16:05:31.293Z"}}},"related_cves":[{"value":"CVE-2026-109347","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:765dcb84-fd8b-4192-985e-ae0ea2daf6af","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109347","advisory_id":"765dcb84-fd8b-4192-985e-ae0ea2daf6af","event_types":["advisory"],"published_at":"2026-10-25T07:43:26.936945+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T16:05:31.293+00:00","detail_url":"/events/28500"}]}},{"id":4765,"cve_ids":["CVE-2026-100697"],"payload":{"kind":"advisory","title":"Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver","summary":"Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.","evidence":"cve:CVE-2026-100697","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100697","aliases":["CVE-2026-100697"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T17:43:47.316Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v","https://www.vulncheck.com/advisories/adminer-6.0.0-server-side-request-forgery-via-clickhouse-driver"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100697","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T17:43:41.148058Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:43:47.316Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:54.288Z"}}},"related_cves":[{"value":"CVE-2026-100697","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3f805b09-ccfc-43f9-8dfb-0eb3a1b0e110","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100697","advisory_id":"3f805b09-ccfc-43f9-8dfb-0eb3a1b0e110","event_types":["advisory"],"published_at":"2026-10-24T21:57:07.206437+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:54.288+00:00","detail_url":"/advisories/advisory%3A3f805b09-ccfc-43f9-8dfb-0eb3a1b0e110","group":{"id":"advisory:3f805b09-ccfc-43f9-8dfb-0eb3a1b0e110","revision":1,"primary_event_id":4784,"change":"published","superseded_by":[],"changed":{"id":4784,"cve_ids":["CVE-2026-100697"],"payload":{"kind":"advisory","title":"Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver","summary":"Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.","evidence":"cve:CVE-2026-100697","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100697","aliases":["CVE-2026-100697"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T17:43:47.316Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v","https://www.vulncheck.com/advisories/adminer-6.0.0-server-side-request-forgery-via-clickhouse-driver"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100697","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T17:43:41.148058Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:43:47.316Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:54.288Z"}}},"related_cves":[{"value":"CVE-2026-100697","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3f805b09-ccfc-43f9-8dfb-0eb3a1b0e110","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100697","advisory_id":"3f805b09-ccfc-43f9-8dfb-0eb3a1b0e110","event_types":["advisory"],"published_at":"2026-10-24T21:57:07.206437+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:54.288+00:00","detail_url":"/events/4784"},"members":[{"id":4784,"cve_ids":["CVE-2026-100697"],"payload":{"kind":"advisory","title":"Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver","summary":"Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.","evidence":"cve:CVE-2026-100697","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100697","aliases":["CVE-2026-100697"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T17:43:47.316Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v","https://www.vulncheck.com/advisories/adminer-6.0.0-server-side-request-forgery-via-clickhouse-driver"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100697","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T17:43:41.148058Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-77qq-q8fv-x45v","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:43:47.316Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:54.288Z"}}},"related_cves":[{"value":"CVE-2026-100697","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3f805b09-ccfc-43f9-8dfb-0eb3a1b0e110","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100697","advisory_id":"3f805b09-ccfc-43f9-8dfb-0eb3a1b0e110","event_types":["advisory"],"published_at":"2026-10-24T21:57:07.206437+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:54.288+00:00","detail_url":"/events/4784"}]}},{"id":4724,"cve_ids":["CVE-2026-34967"],"payload":{"kind":"advisory","title":"Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write","summary":"Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.","evidence":"cve:CVE-2026-34967","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-34967","aliases":["CVE-2026-34967"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"5.3.0","versionType":"semver","lessThanOrEqual":"5.4.2"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T17:20:17.012Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-75xm-qwfq-9wp5","https://www.vulncheck.com/advisories/adminer-sql-log-plugin-through-arbitrary-file-write"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-34967","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T15:29:33.378357Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-75xm-qwfq-9wp5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-25T15:29:49.378Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-30T17:20:17.012Z"}}},"related_cves":[{"value":"CVE-2026-34967","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5eade744-2b6c-4db6-89b6-e4c7207435d2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-34967","advisory_id":"5eade744-2b6c-4db6-89b6-e4c7207435d2","event_types":["advisory"],"published_at":"2026-10-24T21:56:43.017333+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T01:29:59.097+00:00","detail_url":"/advisories/advisory%3A5eade744-2b6c-4db6-89b6-e4c7207435d2","group":{"id":"advisory:5eade744-2b6c-4db6-89b6-e4c7207435d2","revision":1,"primary_event_id":4742,"change":"published","superseded_by":[],"changed":{"id":4742,"cve_ids":["CVE-2026-34967"],"payload":{"kind":"advisory","title":"Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write","summary":"Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.","evidence":"cve:CVE-2026-34967","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-34967","aliases":["CVE-2026-34967"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"5.3.0","versionType":"semver","lessThanOrEqual":"5.4.2"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T17:20:17.012Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-75xm-qwfq-9wp5","https://www.vulncheck.com/advisories/adminer-sql-log-plugin-through-arbitrary-file-write"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-34967","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T15:29:33.378357Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-75xm-qwfq-9wp5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-25T15:29:49.378Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-30T17:20:17.012Z"}}},"related_cves":[{"value":"CVE-2026-34967","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5eade744-2b6c-4db6-89b6-e4c7207435d2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-34967","advisory_id":"5eade744-2b6c-4db6-89b6-e4c7207435d2","event_types":["advisory"],"published_at":"2026-10-24T21:56:43.017333+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T01:29:59.097+00:00","detail_url":"/events/4742"},"members":[{"id":4742,"cve_ids":["CVE-2026-34967"],"payload":{"kind":"advisory","title":"Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write","summary":"Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.","evidence":"cve:CVE-2026-34967","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-34967","aliases":["CVE-2026-34967"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"5.3.0","versionType":"semver","lessThanOrEqual":"5.4.2"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T17:20:17.012Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-75xm-qwfq-9wp5","https://www.vulncheck.com/advisories/adminer-sql-log-plugin-through-arbitrary-file-write"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-34967","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T15:29:33.378357Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-75xm-qwfq-9wp5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-25T15:29:49.378Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-30T17:20:17.012Z"}}},"related_cves":[{"value":"CVE-2026-34967","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5eade744-2b6c-4db6-89b6-e4c7207435d2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-34967","advisory_id":"5eade744-2b6c-4db6-89b6-e4c7207435d2","event_types":["advisory"],"published_at":"2026-10-24T21:56:43.017333+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T01:29:59.097+00:00","detail_url":"/events/4742"}]}},{"id":4428,"cve_ids":["CVE-2026-100698"],"payload":{"kind":"advisory","title":"Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex","summary":"Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2.","evidence":"cve:CVE-2026-100698","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100698","aliases":["CVE-2026-100698"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T15:07:54.104Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj","https://www.vulncheck.com/advisories/adminer-before-6.0.2-privileged-port-ssrf-via-host-port-regex"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100698","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:07:29.504241Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:07:54.104Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:55.058Z"}}},"related_cves":[{"value":"CVE-2026-100698","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98c5dd20-deb7-47dc-8d5d-1a91020148ff","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100698","advisory_id":"98c5dd20-deb7-47dc-8d5d-1a91020148ff","event_types":["advisory"],"published_at":"2026-10-24T21:52:26.193708+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:55.058+00:00","detail_url":"/advisories/advisory%3A98c5dd20-deb7-47dc-8d5d-1a91020148ff","group":{"id":"advisory:98c5dd20-deb7-47dc-8d5d-1a91020148ff","revision":1,"primary_event_id":4446,"change":"published","superseded_by":[],"changed":{"id":4446,"cve_ids":["CVE-2026-100698"],"payload":{"kind":"advisory","title":"Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex","summary":"Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2.","evidence":"cve:CVE-2026-100698","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100698","aliases":["CVE-2026-100698"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T15:07:54.104Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj","https://www.vulncheck.com/advisories/adminer-before-6.0.2-privileged-port-ssrf-via-host-port-regex"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100698","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:07:29.504241Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:07:54.104Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:55.058Z"}}},"related_cves":[{"value":"CVE-2026-100698","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98c5dd20-deb7-47dc-8d5d-1a91020148ff","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100698","advisory_id":"98c5dd20-deb7-47dc-8d5d-1a91020148ff","event_types":["advisory"],"published_at":"2026-10-24T21:52:26.193708+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:55.058+00:00","detail_url":"/events/4446"},"members":[{"id":4446,"cve_ids":["CVE-2026-100698"],"payload":{"kind":"advisory","title":"Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex","summary":"Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2.","evidence":"cve:CVE-2026-100698","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100698","aliases":["CVE-2026-100698"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T15:07:54.104Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj","https://www.vulncheck.com/advisories/adminer-before-6.0.2-privileged-port-ssrf-via-host-port-regex"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100698","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T15:07:29.504241Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-rwxg-xph9-82cj","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:07:54.104Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:55.058Z"}}},"related_cves":[{"value":"CVE-2026-100698","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:98c5dd20-deb7-47dc-8d5d-1a91020148ff","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100698","advisory_id":"98c5dd20-deb7-47dc-8d5d-1a91020148ff","event_types":["advisory"],"published_at":"2026-10-24T21:52:26.193708+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:55.058+00:00","detail_url":"/events/4446"}]}},{"id":3256,"cve_ids":["CVE-2026-100695"],"payload":{"kind":"advisory","title":"Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE","summary":"Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.","evidence":"cve:CVE-2026-100695","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100695","aliases":["CVE-2026-100695"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T17:45:53.936Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-7c5h-q78c-fpxx","https://www.vulncheck.com/advisories/adminer-before-6.0.2-xss-via-connection-id-escalating-to-rce"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100695","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:44:23.167502Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-7c5h-q78c-fpxx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:45:53.936Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:52.929Z"}}},"related_cves":[{"value":"CVE-2026-100695","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:67f37fe3-bcf1-4174-a82d-e65ea590e066","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100695","advisory_id":"67f37fe3-bcf1-4174-a82d-e65ea590e066","event_types":["advisory"],"published_at":"2026-10-24T21:31:58.780125+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:52.929+00:00","detail_url":"/advisories/advisory%3A67f37fe3-bcf1-4174-a82d-e65ea590e066","group":{"id":"advisory:67f37fe3-bcf1-4174-a82d-e65ea590e066","revision":1,"primary_event_id":3268,"change":"published","superseded_by":[],"changed":{"id":3268,"cve_ids":["CVE-2026-100695"],"payload":{"kind":"advisory","title":"Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE","summary":"Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.","evidence":"cve:CVE-2026-100695","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100695","aliases":["CVE-2026-100695"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T17:45:53.936Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-7c5h-q78c-fpxx","https://www.vulncheck.com/advisories/adminer-before-6.0.2-xss-via-connection-id-escalating-to-rce"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100695","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:44:23.167502Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-7c5h-q78c-fpxx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:45:53.936Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:52.929Z"}}},"related_cves":[{"value":"CVE-2026-100695","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:67f37fe3-bcf1-4174-a82d-e65ea590e066","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100695","advisory_id":"67f37fe3-bcf1-4174-a82d-e65ea590e066","event_types":["advisory"],"published_at":"2026-10-24T21:31:58.780125+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:52.929+00:00","detail_url":"/events/3268"},"members":[{"id":3268,"cve_ids":["CVE-2026-100695"],"payload":{"kind":"advisory","title":"Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE","summary":"Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.","evidence":"cve:CVE-2026-100695","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100695","aliases":["CVE-2026-100695"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T17:45:53.936Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-7c5h-q78c-fpxx","https://www.vulncheck.com/advisories/adminer-before-6.0.2-xss-via-connection-id-escalating-to-rce"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100695","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:44:23.167502Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-7c5h-q78c-fpxx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:45:53.936Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:52.929Z"}}},"related_cves":[{"value":"CVE-2026-100695","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:67f37fe3-bcf1-4174-a82d-e65ea590e066","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100695","advisory_id":"67f37fe3-bcf1-4174-a82d-e65ea590e066","event_types":["advisory"],"published_at":"2026-10-24T21:31:58.780125+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:52.929+00:00","detail_url":"/events/3268"}]}},{"id":3187,"cve_ids":["CVE-2026-100696"],"payload":{"kind":"advisory","title":"Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver","summary":"Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker who submits crafted auth[server], auth[username], and auth[password] parameters can cause the Adminer server to issue an HTTP GET request (via get_url()/file_get_contents()) to an arbitrary reachable host and port. The driver validates only general server syntax and does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends the default 9200, and Adminer's generic port check rejects ports below 1024. Selected JSON error fields from non-2xx Elasticsearch-style responses, as well as connection failures, are rendered on the login page, providing a port-scanning oracle and enabling internal network reconnaissance and service fingerprinting. Exploitation requires that the optional Elasticsearch driver be explicitly deployed (e.g., via the adminer/elastic.php template or an adminer_object() configuration; it is not loaded in a default build) and that PHP allow_url_fopen be enabled.","evidence":"cve:CVE-2026-100696","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100696","aliases":["CVE-2026-100696"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T16:28:42.083Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-q8h3-4cx4-prgm","https://www.vulncheck.com/advisories/adminer-before-6.0.2-unauthenticated-ssrf-via-elasticsearch-driver"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100696","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:28:12.462409Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-q8h3-4cx4-prgm","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:28:42.083Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:53.613Z"}}},"related_cves":[{"value":"CVE-2026-100696","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ce944c00-172e-4c2f-a85d-4da3b4ca7ed9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100696","advisory_id":"ce944c00-172e-4c2f-a85d-4da3b4ca7ed9","event_types":["advisory"],"published_at":"2026-10-24T21:31:16.111537+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:53.613+00:00","detail_url":"/advisories/advisory%3Ace944c00-172e-4c2f-a85d-4da3b4ca7ed9","group":{"id":"advisory:ce944c00-172e-4c2f-a85d-4da3b4ca7ed9","revision":1,"primary_event_id":3198,"change":"published","superseded_by":[],"changed":{"id":3198,"cve_ids":["CVE-2026-100696"],"payload":{"kind":"advisory","title":"Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver","summary":"Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker who submits crafted auth[server], auth[username], and auth[password] parameters can cause the Adminer server to issue an HTTP GET request (via get_url()/file_get_contents()) to an arbitrary reachable host and port. The driver validates only general server syntax and does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends the default 9200, and Adminer's generic port check rejects ports below 1024. Selected JSON error fields from non-2xx Elasticsearch-style responses, as well as connection failures, are rendered on the login page, providing a port-scanning oracle and enabling internal network reconnaissance and service fingerprinting. Exploitation requires that the optional Elasticsearch driver be explicitly deployed (e.g., via the adminer/elastic.php template or an adminer_object() configuration; it is not loaded in a default build) and that PHP allow_url_fopen be enabled.","evidence":"cve:CVE-2026-100696","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100696","aliases":["CVE-2026-100696"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T16:28:42.083Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-q8h3-4cx4-prgm","https://www.vulncheck.com/advisories/adminer-before-6.0.2-unauthenticated-ssrf-via-elasticsearch-driver"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100696","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:28:12.462409Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-q8h3-4cx4-prgm","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:28:42.083Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:53.613Z"}}},"related_cves":[{"value":"CVE-2026-100696","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ce944c00-172e-4c2f-a85d-4da3b4ca7ed9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100696","advisory_id":"ce944c00-172e-4c2f-a85d-4da3b4ca7ed9","event_types":["advisory"],"published_at":"2026-10-24T21:31:16.111537+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:53.613+00:00","detail_url":"/events/3198"},"members":[{"id":3198,"cve_ids":["CVE-2026-100696"],"payload":{"kind":"advisory","title":"Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver","summary":"Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before the login result is validated, an unauthenticated attacker who submits crafted auth[server], auth[username], and auth[password] parameters can cause the Adminer server to issue an HTTP GET request (via get_url()/file_get_contents()) to an arbitrary reachable host and port. The driver validates only general server syntax and does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends the default 9200, and Adminer's generic port check rejects ports below 1024. Selected JSON error fields from non-2xx Elasticsearch-style responses, as well as connection failures, are rendered on the login page, providing a port-scanning oracle and enabling internal network reconnaissance and service fingerprinting. Exploitation requires that the optional Elasticsearch driver be explicitly deployed (e.g., via the adminer/elastic.php template or an adminer_object() configuration; it is not loaded in a default build) and that PHP allow_url_fopen be enabled.","evidence":"cve:CVE-2026-100696","products":[{"name":{"value":"adminer","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100696","aliases":["CVE-2026-100696"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"vrana","product":"adminer","versions":[{"status":"affected","version":"0","lessThan":"6.0.2","versionType":"semver"},{"status":"unaffected","version":"6.0.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T16:28:42.083Z","provider":"cve","references":["https://github.com/vrana/adminer/security/advisories/GHSA-q8h3-4cx4-prgm","https://www.vulncheck.com/advisories/adminer-before-6.0.2-unauthenticated-ssrf-via-elasticsearch-driver"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100696","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:28:12.462409Z"}}}],"references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-q8h3-4cx4-prgm","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:28:42.083Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:53.613Z"}}},"related_cves":[{"value":"CVE-2026-100696","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ce944c00-172e-4c2f-a85d-4da3b4ca7ed9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100696","advisory_id":"ce944c00-172e-4c2f-a85d-4da3b4ca7ed9","event_types":["advisory"],"published_at":"2026-10-24T21:31:16.111537+00:00","technologies":["adminer","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:53.613+00:00","detail_url":"/events/3198"}]}}],"next_after":28723,"next_before":3187}