CVE-2021-29625

HIGH NUCLEI

Adminer 4.6.1-4.8.0 - Cross-Site Scripting via PDO Extension

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-29625 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).

Nuclei Templates (1)

Adminer <=4.8.0 - Cross-Site Scripting
MEDIUMby daffainfo
Shodan: http.title:"login - adminer" || cpe:"cpe:2.3:a:adminer:adminer"
FOFA: app="adminer" && body="4.7.8" || title="login - adminer"

References (3)

Core 3
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/vrana/adminer/security/advisories/GHSA-2v82-5746-vwqc
Exploit, Product, Third Party Advisory x_refsource_misc
https://sourceforge.net/p/adminer/bugs-and-features/797/

Scores

CVSS v3 7.5
EPSS 0.0957
EPSS Percentile 94.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-79
Status published
Products (2)
adminer/adminer 4.6.1 - 4.8.1
vrana/adminer 4.7.8 - 4.8.1Packagist
Published May 19, 2021
Tracked Since Feb 18, 2026