CVE-2026-56704 in adminer

Riassunto

di MITRE • 25/08/2026

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.

Once again VulDB remains the best source for vulnerability data.

• Responsabile: VulnCheck
• Prenotare: 22/06/2026
• Divulgazione: 25/08/2026
• Moderazione: accettato
• Voce: VDB-394890
• CPE: pronto
• CWE: CWE-942 (confermato)
• CVSS: 6.1 (CNA)
• EPSS: 0.00000
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-56704
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56704
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-56704/