MEDIUM 5.3 NVD
CVE-2026-56704
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.
References
- https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj
- https://www.vulncheck.com/advisories/adminer-before-cross-site-scripting-via-mysql-version
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-08-25 via NVD.
vulnfeed aggregates 11266 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.