Cross-Site Scripting Vulnerability in Adminer by Adminer

CVE-2026-100695

What is CVE-2026-100695?

Adminer versions prior to 6.0.2 contain a cross-site scripting vulnerability resulting from improper handling of the CONNECTION_ID() database result within JavaScript. This flaw allows an attacker operating a malicious database server to execute arbitrary JavaScript in the context of an authenticated Adminer session. In deployments where the database possesses FILE privileges and can write to the webroot, this XSS can be exploited to submit authenticated SQL commands that generate PHP files via the INTO DUMPFILE directive, potentially leading to remote code execution on the web server.

References