PT-2026-7169 · Adminer · Adminer

Joyghoshs · Publicado 2026-02-09 · Atualizado 2026-02-10 · CVE-2026-25892

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 5.4.2

Description Adminer is database management software. Versions 5.4.1 and earlier have a flawed version check process. The adminer.org domain sends signed version information via JavaScript postMessage, which is then sent by the browser to the ''?script=version'' endpoint. This endpoint does not validate the origin of the POST request, allowing attackers to send a crafted version[] parameter. PHP interprets this parameter as an array, which causes a TypeError when passed to the openssl verify() function, resulting in an HTTP 500 error for all users.

Recommendations Upgrade to Adminer version 5.4.2.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-25892

GHSA-Q4F2-39GR-45JH

Produtos afetados

Adminer

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25892.json · Exploit
• https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3 · Correção
• https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh · Aviso do Fabricante
• https://github.com/vrana/adminer/releases/tag/v5.4.2 · Nota
• https://github.com/vrana/adminer · Nota
• https://ubuntu.com/security/CVE-2026-25892 · Aviso do Fabricante
• https://t.me/CVEtracker/44235 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25892 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-25892 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-25892 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2020982059112468673 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-q4f2-39gr-45jh · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2021117007416967370 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25892 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1r1174e/resumen_diario_de_vulnerabilidades_10022026 · Publicação no Reddit