CVE-2026-56705

ADVISORY - nist

Summary

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.

EPSS Score⁠: 0.00895 (0.585)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-73⁠

External Control of File Name or Path

Impacted images

Advisories

NIST

CREATED

2 months ago

UPDATED

2 days ago

ADVISORY IDCVE-2026-56705⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)

CVSS SCORE

9.3critical

Debian

CREATED

2 months ago

UPDATED

24 days ago

ADVISORY IDCVE-2026-56705⁠

EXPLOITABILITY SCORE

-

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

2 months ago

UPDATED

1 month ago

ADVISORY IDCVE-2026-56705⁠

EXPLOITABILITY SCORE

-

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium