CVE-2026-100695

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100695
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100695.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100695
Aliases
  • GHSA-7c5h-q78c-fpxx
Downstream
Published
2026-09-26T13:23:52Z
Modified
2026-09-28T03:48:30Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
Details

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100695.json"
}
References

Affected packages

Git / github.com/vrana/adminer

Affected ranges

Type
GIT
Repo
https://github.com/vrana/adminer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bac73e4a126f2e5e82d763da4e233e8ebff82055
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.0.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v3.*
v3.0.0
v3.0.1
v3.1.0
v3.2.0
v3.2.1
v3.2.2
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.4.0
v3.5.0
v3.5.1
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.7.0
v3.7.1
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.16.0
v4.17.0
v4.17.1
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.3.0
v4.3.1
v4.4.0
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.7.4
v4.7.5
v4.7.7
v4.7.8
v4.7.9
v4.8.0
v4.8.1
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.1.0
v5.1.1
v5.2.0
v5.2.1
v5.3.0
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.5.0
v5.5.1
v6.*
v6.0.0
v6.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100695.json"